DNA View

Critical Severity Vulnerability

This vulnerability has been rated as Critical severity. Immediate action is recommended.

CVE-2025-13915

Critical

Low Medium High Critical

9.8

CVSS Score

Published: Dec 26, 2025

Last Modified: Dec 31, 2025

CWE: CWE-305

Vulnerability Description

IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

1 configuration(s) from 1 vendor(s)

api_connect

Version:

10.0.11.0

CPE:

cpe:2.3:a:ibm:api_connect:10.0.11.0:*:*:*:*:*:*:*

This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.

References & Resources

https://www.ibm.com/support/pages/node/7255149
psirt@us.ibm.com Vendor Advisory

Severity Details

9.8

out of 10.0

Critical

Weakness Type (CWE)

CWE-305

Authentication Bypass by Primary Weakness

Description: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Typical Severity: Medium
Abstraction Level: Base