Remote Information Disclosure and Configuration Manipulation in IBM Aspera Connect

CVE-2026-120113

What is CVE-2026-120113?

IBM Aspera Connect versions 1.6.1 through 4.2.19 are susceptible to vulnerabilities that allow remote attackers to access sensitive information and alter host trust configurations. This is due to inadequate authentication mechanisms and excessively permissive cross-origin access controls in the local HTTP service. By tricking victims into visiting a malicious webpage, an attacker could execute unauthorized cross-origin requests that compromise configuration settings and sensitive data.

References