IBM WebSphere Application Server Liberty is vulnerable to identity spoofing when the appSecurity feature is not enabled and applications are deployed without authentication or authorization. This flaw, identified as CWE‑269 Improper Privilege Management, allows an attacker to impersonate another user or the system, potentially gaining unauthorized access to privileged functionality. The vulnerability only manifests under the specific configuration conditions described, so its impact is tied to how the server is set up. Additionally, NVD lists a 'noinfo' CWE entry, indicating the presence of another unspecified weakness.

The affected product is IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.4. All releases within that range that have the appSecurity feature disabled are susceptible.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1 % reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a server that is running without the appSecurity feature and has applications deployed without authentication or authorization; these conditions are uncommon, yet if present, an attacker could spoof identities remotely via the web interface. IBM recommends applying the interim fix for APAR PH70352 immediately or upgrading to Fix Pack 26.0.0.5 or later to mitigate the risk.