CVE-2025-13915

Published Dec 26, 2025

Last updated 2 days ago

IBM API Connect

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13915 is a security vulnerability affecting IBM API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. It is classified as an authentication bypass, meaning a remote attacker could potentially bypass authentication mechanisms and gain unauthorized access to the application. No privileges or user interaction are required to exploit this vulnerability. This vulnerability could allow an attacker to gain unauthorized access to the API Connect management interface or backend services. IBM has released a security update to address this vulnerability and advises users of affected products to update to the latest version. If updating is not immediately possible, disabling self-service sign-up on the Developer Portal can help minimize exposure.

Description: IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Source: psirt@us.ibm.com
NVD status: Analyzed
Products: api_connect

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-305

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "93252B35-2824-4183-8D91-E3AAE4ADBB22",
            "versionEndIncluding": "10.0.8.5",
            "versionStartIncluding": "10.0.8.0"
          },
          {
            "criteria": "cpe:2.3:a:ibm:api_connect:10.0.11.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CB79D210-459D-4394-9895-B15DA4069C6A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.