CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-13915

The Open Door Policy: Smashing IBM API Connect for Instant Admin Access

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 1, 2026·6 min read·34 visits

Executive Summary (TL;DR)

IBM API Connect has a CVSS 9.8 hole in its Developer Portal. If 'self-service sign-up' is enabled, the authentication logic fails to properly validate user creation requests. This allows remote attackers to bypass identity verification entirely, potentially registering as administrators or hijacking existing accounts without credentials. IBM has released iFixes; immediate patching or disabling sign-up is required.

A critical authentication bypass in IBM API Connect's Developer Portal allows unauthenticated attackers to hijack accounts or create admin users simply by manipulating the self-service sign-up flow.

Official Patches

IBMIBM Security Bulletin: Vulnerability in API Connect Developer Portal (CVE-2025-13915)

Technical Appendix

CVSS Score
9.8/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.37%
Top 100% most exploited

Affected Systems

IBM API Connect V10.0.8.0 - V10.0.8.5IBM API Connect V10.0.11.0IBM API Connect Developer Portal

Affected Versions Detail

Product
Affected Versions
Fixed Version
IBM API Connect
IBM
10.0.8.0 - 10.0.8.510.0.8.5-iFix
IBM API Connect
IBM
10.0.11.010.0.11.0-iFix
AttributeDetail
CWECWE-305 (Authentication Bypass)
CVSS v3.19.8 (Critical)
Attack VectorNetwork (Remote)
Privileges RequiredNone
EPSS Score0.37% (Low/Emerging)
Exploit StatusNo Public PoC / Internal Discovery

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1078Valid Accounts
Persistence
CWE-305
Authentication Bypass

Authentication Bypass by Primary Weakness

Vulnerability Timeline

IBM publishes Security Bulletin
2025-02-13
CVE-2025-13915 Assigned
2025-02-13

References & Sources

  • [1]IBM Security Bulletin

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 2 hours ago•CVE-2026-39832
9.1

CVE-2026-39832: Silent Drop of Destination Constraints in golang.org/x/crypto SSH Agent Client

A critical security flaw was identified in the Go package golang.org/x/crypto/ssh/agent. The vulnerability arises during the serialization of key constraints when adding SSH identities to a remote agent or an in-memory keyring. Specifically, custom constraint extensions, such as destination restrictions like restrict-destination-v00@openssh.com, were silently omitted from serialization in client requests. This omission allowed keys to be loaded into the remote agent with zero destination-based restrictions, enabling unauthorized users with access to the agent socket on intermediate hosts to authenticate to any downstream host without policy enforcement. The issue was resolved in version v0.52.0 of the golang.org/x/crypto library.

Amit Schendel
Amit Schendel
3 views•7 min read
•about 3 hours ago•CVE-2026-46597
7.5

CVE-2026-46597: Remote Denial of Service in golang.org/x/crypto/ssh via AES-GCM Padding Integer Overflow

A high-severity Denial of Service (DoS) vulnerability (CVE-2026-46597 / GO-2026-5013) exists in the golang.org/x/crypto/ssh module before version v0.52.0. The flaw stems from an incorrect operator order during a type conversion of the GCM packet padding size, allowing a remote, unauthenticated attacker to trigger an out-of-bounds slice runtime panic and crash the Go process.

Alon Barad
Alon Barad
3 views•7 min read
•about 7 hours ago•CVE-2026-39828
6.3

CVE-2026-39828: Go SSH Server PartialSuccessError Permissions Discard Bypass

A critical security bypass vulnerability was discovered in the Go SSH server implementation within the golang.org/x/crypto/ssh package. When an SSH server authentication callback returned a PartialSuccessError alongside non-nil Permissions, the server silently discarded these permissions before the subsequent authentication step. Consequently, once the user completed the second-factor authentication, the session-level restrictions were dropped, granting the client unauthorized capabilities.

Amit Schendel
Amit Schendel
5 views•7 min read
•about 8 hours ago•CVE-2026-39835
5.3

CVE-2026-39835: Remote Denial of Service via Null Pointer Dereference in Go SSH CertChecker

A Denial of Service (DoS) vulnerability exists in the Go SSH implementation package (golang.org/x/crypto/ssh). The vulnerability is caused by a null pointer dereference (runtime panic) when CertChecker is utilized as a public key callback but its validation fields, IsUserAuthority or IsHostAuthority, are uninitialized.

Amit Schendel
Amit Schendel
8 views•7 min read
•about 8 hours ago•CVE-2026-39827
6.5

CVE-2026-39827: Denial of Service via Unbounded Memory Growth in Go SSH (golang.org/x/crypto/ssh)

An unbounded memory leak vulnerability in the Go SSH package (golang.org/x/crypto/ssh) allows authenticated users to crash the server by repeatedly requesting connection channels that are rejected, leading to system resource exhaustion.

Amit Schendel
Amit Schendel
7 views•6 min read
•about 9 hours ago•CVE-2026-39830
9.1

CVE-2026-39830: Unsolicited Response Channel Deadlock and Resource Leak in golang.org/x/crypto/ssh

A denial-of-service (DoS) and resource leak vulnerability in the Go SSH package (golang.org/x/crypto/ssh) allows a malicious peer to permanently deadlock connection processing loops and leak memory. This issue stems from improper handling of unsolicited responses at the global and channel layers, which saturate internal bounded channel buffers and block the main multiplexer loop. The vulnerability is fully resolved in version 0.52.0.

Alon Barad
Alon Barad
5 views•7 min read