IBM WebSphere Application Server versions 9.0 and 8.5 allow an identity spoofing vulnerability that can enable an attacker to impersonate legitimate users or system components, potentially leading to unauthorized access or manipulation of application data. The flaw exists within the authentication or identity verification components that fail to correctly validate the originating party, leaving the system susceptible to spoofed credentials. As a result, confidentiality, integrity, and availability of applications running on the affected servers can be compromised.

The vulnerability affects IBM WebSphere Application Server for all supported releases in the ranges 8.5.0.0 through 8.5.5.29 and 9.0.0.0 through 9.0.5.28. Users should apply the interim fix identified as APAR PH71422 or upgrade to the latest fix pack, namely 9.0.5.29 or newer for the 9.x line, and 8.5.5.30 or newer for the 8.5.x line. This remediation path is documented by IBM and linked from their support pages.

The vulnerability is scored CVSS 9.1, indicating a very high severity level. EPSS data is not available, while the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector for this flaw is remote, as an attacker can impersonate legitimate entities over the network once credentials or identity tokens are presented to the server. Although explicit exploitation details are not provided, the flaw's nature suggests that an intruder with network access could leverage it to gain control over application functions that depend on trusted identities.