CVE-2025-13915
Published: 26 December 2025
Description
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the authentication bypass vulnerability by requiring timely identification, reporting, and correction of flaws such as this CVE through vendor patching.
Enforces approved access authorizations in accordance with policy, preventing unauthorized access resulting from authentication bypass.
Requires robust identification and authentication for users, addressing the core authentication mechanism bypass exploited in this CVE.
Security SummaryAI
CVE-2025-13915 is an authentication bypass vulnerability (CWE-305) in IBM API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. Published on 2025-12-26, it enables a remote attacker to circumvent authentication mechanisms and obtain unauthorized access to the application. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impact potential.
A remote attacker with no required privileges or user interaction can exploit this vulnerability over the network with low complexity. Successful exploitation allows the attacker to gain unauthorized access to the application, resulting in high impacts on confidentiality, integrity, and availability.
IBM provides details on the vulnerability, including mitigation and patch information, in its security advisory at https://www.ibm.com/support/pages/node/7255149. Security practitioners should consult this reference for version-specific remediation guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-13915 is an authentication bypass in IBM API Connect, a public-facing application, enabling remote exploitation for unauthorized access (T1190).