IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass

IBM has disclosed a critical security flaw in API Connect that could allow a remote attacker to bypass authentication and gain unauthorized access to the application, tracked as CVE-2025-13915. The vulnerability is rated 9.8 out of 10 on CVSS and affects IBM API Connect versions 10.0.8[.]0 through 10.0.8[.]5 and 10.0.11[.]0. According to IBM, this authentication bypass could enable remote access, prompting customers to apply the fixes as soon as possible.

Customers are advised to download the fix from Fix Central, extract the filesReadme[.]md and ibm-apiconnect-<version>-ifix.13195.tar[.]gz, and apply the fix based on their API Connect version. If installation of the interim fix is not possible, IBM recommends disabling self-service sign-up on the Developer Portal to minimise exposure.