This vulnerability allows a remote attacker to execute server‑side request forgery, enabling the system to send arbitrary HTTP/S requests. The attacker can use it for network enumeration, data exfiltration, or to reach internal services that are otherwise inaccessible. The weakness is classified as CWE‑918.

Affected systems are IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3. Both the core Liberty runtime and configurations that enable the samlWeb‑2.0 feature are susceptible.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score below 1% suggests low exploitation probability. Because this is not listed in CISA’s KEV catalog, there is no known mass exploitation. The attack vector is inferred to be remote via a web application facing interface that processes user‑controlled input, and exploitation requires that the affected feature is enabled.