An unauthenticated remote attacker can send a specially crafted HTTP request to any URL within the Navigator application on IBM i 7.3 through 7.6 before the user is authenticated. This flaw allows the attacker to bypass access control by altering the server‑side session security state, leading to unauthorized actions and potential escalation of privileges. The vulnerability mainly affects the integrity of authentication mechanisms.

IBM i versions 7.3, 7.4, 7.5, and 7.6 are impacted. The flaw exists in the Navigator application component that accepts HTTP requests without proper authentication checks.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on a crafted HTTP request to a public Navigator endpoint, and does not require privileged access to the target system.