IBM API Connect Authentication Bypass Vulnerability Allowing Unauthorized Access

An authentication bypass vulnerability has been identified in IBM API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. This vulnerability could enable a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the application, allowing attackers to interact with the application as an authenticated user.

Remediation

Users are advised to upgrade to a version that includes the iFix patch. Instructions for downloading the patched versions are available on the IBM Support page. For those unable to upgrade, it is recommended to disable self-service sign-up on the Developer Portal, if enabled, to reduce exposure to this vulnerability.