CVE-2026-93909: IBM WebSphere Application Server Liberty is affected by an authentication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
Other sources
IBM WebSphere Application Server Liberty is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Patch DT502359
Event History
Frequently Asked Questions
Which deployments are affected?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected when the samlWeb-2.0 feature is enabled. Deployments without that feature enabled are not identified as affected by the provided information.
What access does an attacker need to exploit this issue?
The severity vector indicates network-based exploitation with low attack complexity. It also indicates that no prior privileges or user interaction are required.
What is the likely impact of successful exploitation?
The severity vector rates confidentiality and integrity impact as high. It does not indicate an availability impact.
How can I determine whether my environment is exposed?
Check whether your Liberty installation is running a version from 17.0.0.3 through 26.0.0.10 and whether the samlWeb-2.0 feature is enabled. Both conditions are identified for the vulnerability.