{"id":"CVE-2026-93895","published":"2026-10-13T21:19:57.743","lastModified":"2026-10-17T02:18:49.790","description":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7292228","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM WebSphere Liberty servers are vulnerable to an authentication bypass that allows unauthenticated attackers to access gRPC service methods configured with specific access controls. This critical flaw means attackers can gain unauthorized access to protected services without needing credentials.","exploitability":"The exploit is straightforward and requires no authentication or user interaction, making it highly attractive to attackers who can reach the affected gRPC endpoints.","blast_radius":"The impact could be significant across all applications using affected Liberty versions, potentially exposing sensitive gRPC services to unauthorized access and data leakage.","remediation":"Upgrade to IBM WebSphere Application Server - Liberty 26.0.0.11 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","grpc","ibm","remote"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:06.807Z"}}