Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
Published: 2026-10-13
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication bypass
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in IBM WebSphere Application Server Liberty allows an attacker to bypass authentication when the samlWeb-2.0 feature is enabled. The flaw is a form of privilege escalation that permits unauthorized access to protected resources without valid credentials. This weakness corresponds to CWE-384.

Affected Systems

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected when the samlWeb-2.0 feature is active. Only installations that have enabled this feature are vulnerable.

Risk and Exploitability

The CVSS score of 9.1 indicates a high severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis. The vulnerability is not yet listed in CISA KEV. Based on the description, the likely attack vector is inferred to be remote, via the web interface that processes SAML requests, and would not require local privileges.

Generated by OpenCVE AI on October 16, 2026 at 04:20 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT502359. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 .  For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10 using the samlWeb-2.0 feature:  · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502359 https://www.ibm.com/support/pages/node/7291426 --OR-- · Apply Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026).  Additional interim fixes may be available and linked off the interim fix download page.

OpenCVE Recommended Actions

  • Verify whether the samlWeb-2.0 feature is enabled in the Liberty configuration.
  • Download and apply the interim fix for APAR DT502359, or upgrade to the minimal required fix pack levels and then apply the interim fix.
  • Upgrade to Liberty Fix Pack 26.0.0.11 or later when it becomes available.
  • If the samlWeb-2.0 feature is not required, remove or disable it to eliminate the vulnerability.

Generated by OpenCVE AI on October 16, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Ibm websphere Application Server
CPEs cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*
Vendors & Products Ibm websphere Application Server

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
Title IBM WebSphere Application Server Liberty is affected by an authentication bypass
First Time appeared Ibm
Ibm websphere Application Server Liberty
Weaknesses CWE-384
CPEs cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server Liberty
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Ibm Websphere Application Server Websphere Application Server Liberty
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-14T14:08:40.761Z

Reserved: 2026-09-18T20:50:11.214Z

Link: CVE-2026-93909

cve-icon Vulnrichment

Updated: 2026-10-14T14:08:35.639Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T21:19:57.977

Modified: 2026-10-22T18:56:26.697

Link: CVE-2026-93909

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T11:15:13Z

Weaknesses