IBM WebSphere Application Server 8.5 and 9.0 contain a flaw in the CSIv2 inbound propagation handler that permits remote authentication bypass. The weakness, classified as CWE‑287, means that a malicious actor can supply crafted requests to the application server and gain access without valid credentials, potentially allowing full control over the affected environment.

The issue affects IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.31 and 9.0.0.0 through 9.0.5.29. IBM recommends applying the interim fix DT502673 for the affected release, or upgrading to Fix Pack 8.5.5.32 or later for the 8.5 line, and Fix Pack 9.0.5.30 or later for the 9.0 line. Additional interim fixes may be available on IBM’s support site.

With a CVSS score of 8.1, the vulnerability presents a high severity risk. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the remote authentication bypass nature of the flaw means a network‑reachable attacker can exploit it without prior compromising of the target. The attack vector is inferred to be remote due to the nature of web‑based request handling.