IBM WebSphere Application Server: Bypass of cryptographic signature verification
Summary
IBM WebSphere Application Server Liberty (17.0.0.3 to 26.0.0.10) and the traditional WebSphere Application Server 8.5 and 9.0 do not properly verify cryptographic signatures. A remote, unauthenticated attacker may bypass this check, which IBM rates with high confidentiality and integrity impact. According to IBM, the flaw affects Liberty deployments that use the openidConnectClient-1.0, openidConnectServer-1.0, socialLogin-1.0, jwt-1.0 or jwtSso-1.0 features; the attack complexity is high.
Affected
- WebSphere Application Server Liberty 17.0.0.3 to 26.0.0.10 (relevant when the openidConnectClient-1.0, openidConnectServer-1.0, socialLogin-1.0, jwt-1.0 or jwtSso-1.0 features are used)
- WebSphere Application Server 8.5
- WebSphere Application Server 9.0
Fixed in
- Liberty: interim fix for APAR DT502997, or Fix Pack 26.0.0.11 or later (targeted availability 4Q2026)
- Traditional 9.0.0.0 to 9.0.5.29: interim fix for APAR DT503882, or Fix Pack 9.0.5.30 or later (targeted availability 4Q2026)
- Traditional 8.5.0.0 to 8.5.5.31: interim fix for APAR DT503882, or Fix Pack 8.5.5.32 or later (targeted availability 4Q2026)
Workaround
- IBM documents no workaround or mitigation.
- Unverified general measure: disable the JWT, OIDC and social-login features on Liberty servers that do not need them until the fix is applied.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable.
- No evidence of exploitation in the wild found; a third-party tracker lists it as not in the CISA KEV catalogue.
- No public proof of concept found.
- EPSS: 0.21 percent.
Our recommendation
- Identify all Liberty and WebSphere 8.5/9.0 instances and check whether the JWT, OIDC or social-login features are enabled.
- Apply the interim fix or fix pack for each product line as listed by IBM, prioritising internet-facing systems.
- Disable unused token and SSO features until patching is complete.
- Recheck NVD and the CISA KEV catalogue, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-101294 www.ibm.com
- OpenLiberty docs issue 8583 github.com
- CVE-2026-101294 on CVEdetails (IBM WebSphere Application Server) www.cvedetails.com
- CVE-2026-101294 on Strix www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:14.
Original description (NVD)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.