CVE-2026-93909 is a critical authentication bypass in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10. According to IBM, it affects servers that have the samlWeb-2.0 feature enabled.
What Is It
IBM's PSIRT disclosed an authentication bypass in WebSphere Application Server - Liberty. IBM says the flaw can only be triggered when the samlWeb-2.0 feature is enabled. That feature handles SAML 2.0 web single sign-on.
IBM classifies the weakness as CWE-384. NVD published the record on October 13, 2026, and its status is still "Received," so NVD has not yet added its own analysis.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.1 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. That vector means:
- Network-reachable: an attacker does not need local access.
- Low attack complexity: no special conditions are required.
- No privileges and no user interaction required.
- High impact on confidentiality and integrity. Availability is not affected.
When an authentication bypass is reachable over the network without credentials, it can expose applications and data behind the authentication layer. SAML is often the front door for enterprise applications, so any Liberty deployment that relies on samlWeb-2.0 for access control should be reviewed.
No CISA KEV data was available for this CVE when this brief was written. The CISA Known Exploited Vulnerabilities catalog does not currently confirm active exploitation. That can change, so watch the catalog for updates.
What's Vulnerable
- Vendor: IBM
- Product: WebSphere Application Server - Liberty
- Affected versions: 17.0.0.3 through 26.0.0.10, inclusive
- Condition (per IBM): the
samlWeb-2.0feature is enabled
IBM does not describe Liberty servers without samlWeb-2.0 enabled as affected.
Patch Status
The NVD record points to an IBM support bulletin (node 7292236) as the vendor reference for this issue. The supplied record does not name fixed versions or interim fixes. Administrators should:
- Check whether any Liberty servers in the affected range have
samlWeb-2.0enabled. - Read the IBM bulletin for the fixed release or interim fix, and apply it.
- Patch internet-facing SAML-enabled instances first.
No CISA-required action or remediation deadline is available for this CVE.