IBM WebSphere Application Server 8.5 and 9.0 allow a remote attacker to bypass authentication by sending a specially crafted unauthenticated request to a protected WebSphere endpoint. The flaw disables the normal authentication check, enabling the attacker to access resources or administrative interfaces that should be restricted to authenticated users. This access control weakness (CWE‑862) permits unauthorized use of the application server, potentially exposing confidential data, altering configuration, or enabling denial of service.

Vendors affected are IBM WebSphere Application Server, versions 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28. The advisory specifically lists all installations within these version ranges as vulnerable, requiring remediation by applying the interim fix for APAR DT496677 or upgrading to the targeted fix pack levels (8.5.5.31 or later, 9.0.5.29 or later).

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation at the present time. The vulnerability has not been listed in the CISA KEV catalog. Exploitation would occur via a remote crafted request to the application server; any network‑connected attacker who can reach the WebSphere endpoint could trigger the authentication bypass, especially if the server is exposed to untrusted networks.