Article Details
Scrape Timestamp (UTC): 2025-12-31 13:40:25.738
Source: https://thehackernews.com/2025/12/ibm-warns-of-critical-api-connect-bug.html
Original Article Text
Click to Toggle View
IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass. IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915, is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - Customers are advised to follow the steps outlined below - "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exposure to this vulnerability," the company added. API Connect is an end-to-end application programming interface (API) solution that allows organizations to create, test, manage, and secure APIs located on cloud and on-premises. It's used by companies like Axis Bank, Bankart, Etihad Airways, Finologee, IBS Bulgaria, State Bank of India, Tata Consultancy Services, and TINE. While there is no evidence of the vulnerability being exploited in the wild, users are advised to apply the fixes as soon as possible for optimal protection.
Daily Brief Summary
IBM announced a critical vulnerability in API Connect, tracked as CVE-2025-13915, with a CVSS score of 9.8, potentially allowing attackers to bypass authentication remotely.
The flaw affects multiple versions of API Connect, a widely used solution for managing APIs in cloud and on-premises environments.
Impacted organizations include major entities such as Axis Bank, Etihad Airways, and Tata Consultancy Services, highlighting the widespread use of the affected software.
IBM advises users to apply interim fixes promptly or disable self-service sign-up on Developer Portals to mitigate exposure to the vulnerability.
Although there is no current evidence of exploitation, the potential for unauthorized access necessitates immediate action to safeguard systems.
This incident serves as a reminder of the critical importance of regular patch management and vulnerability assessment in maintaining secure API infrastructures.