CVE-2025-13915: Critical 9.8 Flaw in IBM API Connect Lets Attackers Bypass Login

CVE-2025-13915 is described as a critical 9.8 flaw in IBM API Connect that could let remote attackers bypass authentication and gain unauthorised access to the application. IBM has issued an urgent security alert noting that the vulnerability could allow attackers to walk past login mechanisms without a password. The flaw affects specific versions of API Connect: V10.0.8.0 through V10.0.8.5 and V10.0.11.0, with IBM strongly recommending upgrading to address the issue.

Interim fixes (iFixes) have been released for the 10.0.8.x branch and for 10.0.11. For organisations unable to take systems offline immediately, IBM offers a temporary mitigation: disable self-service sign-up on the Developer Portal if enabled, to help minimise exposure until a permanent fix can be applied, according to the advisory.