A flaw in the authentication logic of IBM Aspera High‑Speed Transfer Server for Cloud Pak for Integration allows an attacker to bypass credential checks and gain access to the system as if authenticated. The vulnerability is classified as CWE‑287 and can result in unauthorized reading, modification, or deletion of protected data and control operations. No escalation to elevated privileges is required; simply accessing the service as an authenticated user is sufficient to exploit the weakness.

IBM Aspera High‑Speed Transfer Server for Cloud Pak for Integration, versions 1.5.1 through 1.5.19, are affected. The vulnerability is present in the product released under the CP4I bundle and has been identified by IBM's CNAs as a critical authentication deficiency. All other versions, including 1.5.20 and later, are not affected according to the advisory.

The CVSS vector is not published and the EPSS score is unavailable; the vulnerability is not listed in CISA's KEV catalog. Therefore, the public exploitation probability cannot be quantified, but the presence of a direct authentication bypass suggests a high potential for exploitation in environments where the Aspera service is exposed to network traffic. An attacker who can reach the vulnerable endpoints can craft a request that satisfies the authentication logic without providing valid credentials, thereby obtaining unrestricted access to the server and its data. The impact is wide, affecting confidentiality, integrity, and availability of the services it protects.