Flaw Lets Attackers-over/”>Critical IBM API Connect Flaw Lets Attackers Bypass

Okay, so there’s been a critical security alert issued. It’s about a pretty severe vulnerability found in the IBM API Connect Flaw to just bypass authentication mechanisms entirely.

Discovered during internal testing, the flaw poses a significant risk to organizations relying on the platform for API management. It grants unauthorized actors access to the application without requiring valid credentials.

The vulnerability, tracked as CVE-2025-13915, has been assigned a critical CVSS base score of 9.8 out of 10. This near-maximum score reflects the ease of exploitation and the high impact on confidentiality, integrity, and availability.

The flaw is classified under CWE-305, which refers to an “Authentication Bypass by Primary Weakness.” According to the advisory, the issue allows a remote attacker to circumvent the login process entirely.

Because the attack vector is network-based (AV: N) and requires no special privileges (PR: N) or user interaction (UI: N), the risk of automated or widespread exploitation is high.

The vulnerability impacts specific versions of IBM API Connect. Administrators are urged to check their deployments for the following versions:

IBM strongly recommends that all affected customers upgrade immediately to the patched versions. The company has released iFixes for the affected release ranges.

For organizations that cannot immediately apply the patch, IBM has provided a temporary mitigation. Administrators should disable self-service sign-up on their Developer Portal if it is currently enabled.

While this does not fix the underlying code flaw, it helps minimize the attack surface and reduces exposure to this specific vulnerability until the permanent fix can be deployed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.