Act nowDisclosed

Advisory · CVE-2026-93909

SAML authentication bypass in WebSphere Liberty when samlWeb-2.0 is enabled

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 has an authentication bypass when the samlWeb-2.0 feature is enabled. IBM rates it CVSS 3.1 9.1.

Advisory published October 13, 2026Independent summary
Vendor
IBM
Product
WebSphere Application Server Liberty
Identifier / CWE
CVE-2026-93909
CWE-384
Action timing
Immediate
ELI5

Explain it like I’m five

If your Liberty server uses the SAML sign-in feature, the sign-in itself can be bypassed, which is the one door that has to work.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Target a SAML-enabled server

    An attacker finds a Liberty instance running the samlWeb-2.0 feature.

  2. 02Exploit the bypass

    The attacker uses the authentication bypass weakness in the SAML flow.

  3. 03Session established

    The attacker gains an authenticated session without valid credentials.

  4. 04Application access

    The session is used against whatever the Liberty applications expose.

What happened

IBM disclosed CVE-2026-93909 for WebSphere Application Server Liberty releases 17.0.0.3 through 26.0.0.10. Per IBM, the server has an authentication bypass vulnerability (CWE-384 listed) when the samlWeb-2.0 feature is enabled.

No fixed version is named in the NVD record, so remediation follows the IBM bulletin rather than a version guess here.

What to do

  1. Inventory every WebSphere Application Server Liberty deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to WebSphere Application Server Liberty while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for SAML logins with malformed or replayed assertions, sessions with no matching identity provider record, and logins from new locations.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Authentication bypass on the identity path is a top-tier fix. Apply the IBM bulletin, then review sessions the SAML feature issued.