{"id":"CVE-2026-93909","published":"2026-10-13T21:19:57.977","lastModified":"2026-10-14T16:08:15.347","description":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-384"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7292236","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM WebSphere Application Server - Liberty is vulnerable to an authentication bypass when the SAML Web 2.0 feature is enabled, allowing attackers to gain unauthorized access to protected resources without proper credentials.","exploitability":"Exploitation appears straightforward with no special preconditions required, as the vulnerability affects the core authentication mechanism when SAML is enabled.","blast_radius":"The impact could be significant across all applications running on the affected Liberty server that rely on SAML authentication, potentially exposing sensitive data and application functionality to unauthorized users.","remediation":"Disable the samlWeb-2.0 feature immediately if SAML authentication is not required, or upgrade to IBM WebSphere Application Server - Liberty version 26.0.0.11 or later which contains the fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","saml","web","ibm"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:12.401Z"}}