Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-93909: IBM WebSphere Liberty can be logged into without credentials
CVE-2026-93909 · published today
Summary
Versions of IBM WebSphere Application Server Liberty from 17.0.0.3 up to 26.0.0.10 let users bypass login when the samlWeb-2.0 feature is turned on. An attacker could gain unauthorized access to the server and the applications it hosts. Update to a patched version or disable the samlWeb-2.0 feature until you can apply the fix.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | websphere application server - liberty | <= 26.0.0.10 |
Original advisory text
IBM WebSphere Application Server Liberty is affected by an authentication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
References
- https://www.ibm.com/support/pages/node/7292236 vendor-advisory patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-384Session Fixation
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta