IBM i versions 7.3 through 7.6 contain a flaw where the WebSocket origin header is not properly validated. As a result, a remote attacker who can initiate a WebSocket connection may send requests from an untrusted origin and have those requests accepted by the system. This bypass can lead to the disclosure of sensitive information that is normally protected by the origin check, although it does not provide arbitrary code execution or complete system compromise.

Affected products include IBM i Release 7.3, 7.4, 7.5, and 7.6 with Navigator for i and Digital Certificate Manager fors such as SJ11196, SJ11337, SJ11197, SJ11336, SJ11200, SJ11335, SJ11187, SJ11394, SJ11377, SJ11376, SJ11375, and SJ11374 that address the vulnerability for the corresponding releases.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The exploit requires network connectivity and the ability to initiate a WebSocket handshake with the target system. An attacker who succeeds can read data that is otherwise protected, but the attack does not provide arbitrary code execution or privilege escalation.