CVE-2026-93909

Summary

IBM WebSphere Application Server - Liberty is vulnerable to an authentication bypass when the SAML Web 2.0 feature is enabled, allowing attackers to gain unauthorized access to protected resources without proper credentials.

Exploitability

Exploitation appears straightforward with no special preconditions required, as the vulnerability affects the core authentication mechanism when SAML is enabled.

Blast radius

The impact could be significant across all applications running on the affected Liberty server that rely on SAML authentication, potentially exposing sensitive data and application functionality to unauthorized users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the samlWeb-2.0 feature immediately if SAML authentication is not required, or upgrade to IBM WebSphere Application Server - Liberty version 26.0.0.11 or later which contains the fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.