IBM WebSphere Application Server Liberty: Authentication bypass with samlWeb-2.0
Summary
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected when the samlWeb-2.0 feature (SAML Web SSO) is enabled. A remote, unauthenticated attacker can bypass authentication over the network without user interaction and potentially gain access to protected functions. IBM classifies the weakness as CWE-384 Session Fixation, while the description refers to an authentication bypass. Servers without samlWeb-2.0 are not affected.
Affected
- IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10
- Only with the samlWeb-2.0 feature enabled
- Individual affected builds not confirmed by the vendor
Fixed in
- Interim fix for APAR DT502359 (apply the minimum fix pack level it requires first)
- Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026, release not confirmed)
Workaround
- IBM lists no workaround in the security bulletin.
- Disable samlWeb-2.0 if it is not needed (own recommendation, not from IBM).
- Restrict network access to the Liberty HTTP(S) endpoints, especially the SAML login and callback paths.
Exploitation
- No confirmed exploitation in the sources reviewed. CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total.
- A third-party tracker reports it is not listed in the CISA KEV catalogue; check the KEV catalogue directly.
- No public proof of concept found.
Our recommendation
- Check whether Liberty is in use, including as part of vendor products, and whether samlWeb-2.0 is enabled.
- Apply the interim fix for APAR DT502359, or Fix Pack 26.0.0.11 or later once available.
- If SAML Web SSO is not needed, disable samlWeb-2.0 after confirming the login flow is not affected.
- Restrict access to the SAML login and callback endpoints to required users and identity providers.
- Review logs for unexpected SAML logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: CVE-2026-93909 www.ibm.com
- CVE-2026-93909 (NVD/CVE data mirror) cve.threatint.com
- CVE-2026-93909 (third-party tracker) www.strix.ai
- Critical IBM WebSphere Liberty vulnerabilities patched (SecurityOnline) securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:38.
Original description (NVD)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.