IBM Aspera Connect versions 1.6.1 through 4.2.19 contain a missing authentication check for the local HTTP service and overly permissive cross‑origin access controls. An attacker who can convince a victim to visit a malicious web page can trigger the victim’s browser to send cross‑origin requests to the local service. These requests allow the attacker to read sensitive information exposed by the service and modify host trust configuration, effectively compromising data confidentiality and integrity. The weakness is a classic case of missing authentication for a function (CWE‑306).

The vulnerable range covers all IBM Aspera Connect releases from 1.6.1 up to 4.2.19 on Linux, macOS, and Windows. The remediation available is upgrade to version 4.2.20 or newer, which eliminates the flaw by requiring proper authentication and tightening cross‑origin policies.

The disclosed CVSS score of 6.4 indicates moderate severity. EPSS information is not available and the vulnerability is not catalogued in the CISA KEV list. The attack vector requires social engineering to lure a user to a malicious site that initiates cross‑origin requests to the local HTTP service. While direct remote code execution is not possible, the ability to modify host trust settings can undermine system security and enable further malicious activity. Overall, the risk is moderate but the impact on compromised data and configuration warrants prompt action.