CVE-2025-13915

The vulnerability classified as CWE-305 (Authentication Bypass by Primary Weakness) means that there is a flaw in the authentication process implementation that allows it to be bypassed without possessing valid credentials. An attacker can send a crafted network request to the vulnerable system and gain access to the application while bypassing the required login. The attack is possible remotely over the network without needing any privileges in the system.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to IBM API Connect applications, which may lead to complete compromise of confidentiality, integrity, and availability of managed resources and APIs.

Patches available from the vendor should be applied according to the references — detailed information and patches are available at: https://www.ibm.com/support/pages/node/7255149

IBM API Connect in versions 10.0.8.0 to 10.0.8.5 and version 10.0.11.0