IBM WebSphere Application Server Liberty versions 22.0.0.11 through 26.0.0.5 contain a timing‑based security bypass that could allow a remote attacker to circumvent configured security controls under limited conditions. The vulnerability exploits a specific window where a security check is not correctly enforced, potentially allowing the attacker to gain privileges or access resources they should not normally reach. The weakness reflects a race condition that requires precise timing to succeed, making exploitation more complex than a simple code injection or privilege escalation flaw.

The vulnerability affects IBM WebSphere Application Server – Liberty in the 22.0.0.11 through 26.0.0.5 release range, specifically when using the appSecurity‑3.0, appSecurity‑4.0 or appSecurity‑5.0 feature(s). These are the only configurations documented to be susceptible; other feature sets are not known to be affected.

The CVSS score of 4.4 categorizes the flaw as moderate severity. No EPSS score is available, so the likelihood of exploitation is uncertain but not considered high. The vulnerability is not listed in the CISA KEV catalog, which suggests no publicly known exploits have been observed. Successful exploitation would require a remote attacker with network access to the Liberty instance and precise timing to win the race condition. Because the flaw requires coordinated timing rather than arbitrary input, operational attack complexity is elevated, reducing the probability of successful attacks compared to simpler flaws.