CRITICAL VULNERABILITY IN IBM API CONNECT COULD ALLOW AUTHENTICATION BYPASS

Summary from the TLDR InfoSec newsletter

IBM has disclosed CVE-2025-13915, a critical authentication bypass vulnerability with a CVSS score of 9.8 affecting API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0, that allows remote attackers to gain unauthorized access without user interaction. The flaw, classified as CWE-305, breaks the architectural assumption that API gateways enforce identity and trust, causing downstream services to inherit unvalidated trust and enabling silent exposure propagation across connected systems. Organizations should immediately apply IBM's interim fixes or disable self-service sign-up on the Developer Portal while conducting inventory assessments of API dependencies and monitoring for abnormal behavior to identify which services implicitly trust the gateway.