IBM patches critical authentication bypass flaw in API Connect
Take action: If you are using API Connect, this is an urgent and important patch. Patch the system ASAP. Until you can patch, disable the self-service sign-up feature to block attackers from skipping the login. If possible, isolate the API Connect service from the public internet and make it accessible via trusted networks.
Learn More
IBM reports a major flaw in its API Connect platform that allows attackers to skip the login process entirely and break into private systems.
The flaw is tracked as CVE-2025-13915 (CVSS score 9.8), classified as authentication bypass.
Affected versions are:
- Version 10.0.8.0 through 10.0.8.5
- Version 10.0.11.0
IBM released interim fixes (iFixes) for these versions to stop the threat. Security teams should go to the IBM Support Portal to get the right patches for their system. Upgrading to the latest version is the best way to keep the platform safe from these types of attacks.
IBM advises administrators who can't install the patch immediately to turn off self-service sign-up on the Developer Portal. This stops the primary vector ttackers use to exploit this flaw. Disabling the self-service signup should be considered only a temporary stopgap and the official patch should be applied.
