Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T20:16:42.310Z",
  "pubdate": "2026-09-14T20:16:42.310Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Navigator for i component of IBM i versions 7.3, 7.4, 7.5, and 7.6. This flaw allows a remote, unauthenticated attacker to bypass session IP binding mechanisms. By circumventing the association between a valid session token and the originating IP address, an unauthorized party can potentially hijack or gain unauthorized access to sensitive information managed through the Navigator for i web interface. The vulnerability arises from an improper validation process within the session management logic. Successful exploitation grants an attacker the ability to interact with the system as a legitimate user, potentially exposing proprietary data or administrative configuration details. This issue represents a significant risk to data confidentiality and session integrity, as it removes the primary network-layer verification step intended to prevent session theft and cross-context impersonation. No user interaction is required for a remote attacker to achieve this bypass, making the attack surface high for any environment where Navigator for i is exposed to network traffic.",
  "technicalDetails": "The vulnerability resides within the session management architecture of the Navigator for i web application. Specifically, the system fails to strictly enforce IP address binding for established session tokens during the transition between authenticated states or across sub-requests within the application framework. In a secure implementation, session tokens are cryptographically linked to the client's source IP address; any deviation in the IP address for subsequent requests should result in session invalidation. In the affected versions of IBM i, this binding mechanism is improperly implemented, allowing an attacker to reuse captured session identifiers from an arbitrary IP address without triggering a security exception.\nThe attack flow begins with an attacker capturing a valid session token, which may be facilitated through side-channel leaks, man-in-the-middle interceptions, or other session exposure techniques. Once the token is obtained, the attacker does not need to possess the original client's network environment. By crafting HTTP requests that include the hijacked session cookie or token, the attacker directs these requests to the Navigator for i endpoint. Because the server-side logic fails to verify that the source IP address matches the IP address associated with the initial token issuance, the Navigator for i backend accepts the request as legitimate.\nThe component responsible for this failure is the session state validation function within the web container of the Navigator for i interface. The root cause is the reliance on incomplete validation logic that fails to account for session persistence in scenarios where the source IP header might be manipulated or ignored during the session check. This allows for total session impersonation. Once the session is successfully hijacked, the attacker assumes the privileges of the authenticated user. Depending on the session owner's permissions, this could result in full administrative control over the IBM i system, allowing for the extraction of sensitive system data, modification of configuration parameters, or execution of arbitrary management commands through the interface.\nThe exposure is strictly remote, requiring network reachability to the web server hosting Navigator for i. Because the vulnerability allows for unauthenticated access by leveraging bypassed session controls, the privilege requirements are circumvented entirely once the token is obtained. There is no requirement for the attacker to possess an existing account on the target IBM i instance, provided a valid session state can be reconstructed or hijacked from a legitimate user."
}