IBM WebSphere Application Server Liberty authentication bypass with samlWeb-2.0 enabled (CVE-2026-93909)

What happened

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 have an authentication bypass when the samlWeb-2.0 feature is enabled. The CVSS 3.1 score is 9.1, rated critical, reflecting that an unauthenticated attacker can exploit the issue over the network with low complexity and no user interaction. Successful exploitation can compromise confidentiality and integrity. Because no privileges or user interaction are required, any internet-facing or otherwise untrusted-network reachable Liberty server with the feature enabled is a potential target.

The CVE record classifies the weakness as CWE-384, session fixation. IBM has not stated exploitation in the wild, and the record marks the issue as not publicly disclosed. There is no CISA KEV entry for this CVE.

Who is affected

IBM WebSphere Application Server - Liberty, 17.0.0.3 through 26.0.0.10, when the samlWeb-2.0 feature is enabled. WebSphere Liberty is typically used as a Java application server for web applications and services, often sitting behind identity and access management systems. Only deployments with samlWeb-2.0 active are affected; if the feature is not enabled, this issue does not apply.

What to do now

1. Apply the vendor fix. The CVE record indicates a fix is available; IBM's support page is the authoritative source for patched builds: IBM support page.
2. Until you have patched, restrict network access to affected Liberty servers so that untrusted clients cannot reach them. Prioritise deployments that are reachable from the internet or partner networks.
3. Confirm whether samlWeb-2.0 is enabled on each Liberty instance in your estate. Servers with the feature enabled are the urgent cases.
4. No workaround has been published in the CVE record.

How to detect it

Identify affected instances by checking the Liberty version (17.0.0.3 through 26.0.0.10) and whether samlWeb-2.0 is enabled. If you maintain a configuration management database, query it for Liberty deployments with that feature enabled. Monitor authentication events from those servers for unexpected access or session reuse.

Beyond the patch

An authentication bypass reachable without credentials is the kind of exposure that should be visible before a bulletin arrives. Virtual CISO Services can map the externally reachable Liberty servers in your estate and prioritise them for patching. If a fix cannot be applied immediately, Managed Detection & Response detects the anomalous session and credential activity that follows an authentication bypass.