IBM WebSphere Application Server and Liberty allow a remote attacker to bypass cryptographic signature verification due to an omitted cryptographic step. The vulnerability is a form of improper handling of certificates, which can lead to authentication bypass. The weakness is identified by CWE‑325. Essentially, the system accepts data or modules that have not been properly authenticated, compromising integrity and confidentiality.

Affected products include IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 and the traditional IBM WebSphere Application Server versions 8.5.0.0 to 8.5.5.31. IBM recommends applying the interim fix DT502997 for Liberty or DT503882 for traditional servers. After installing the interim fix, the affected systems should be upgraded to the minimal required fix pack – Liberty 26.0.0.11 or later, traditional 9.0.5.30 or 8.5.5.32 – when these patch levels become available.

The CVSS score is 8.7, indicating high severity, while the EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote, implying that an attacker can trigger the flaw over the network without local access. Prompt application of the interim fix and subsequent upgrade is critical to mitigate the risk of unauthorized access and potential integrity compromise.