External risk intelligence

IBM WebSphere Liberty SAML Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-93909

IBM WebSphere Application Server is a primary platform for hosting public-facing web applications and APIs. When the SAML 2.0 feature is enabled for authentication, it is designed to handle identity management and web-based authentication traffic directly, placing it at the network edge as a public-facing component.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in IBM WebSphere Application Server, specifically when the SAML 2.0 authentication feature is enabled, allows unauthorized access without proper credentials. Given the platform's role in hosting public-facing applications and APIs, this issue could potentially impact the security of sensitive data and services. The main concern is confirming relevance and exposure.

Bypass security, allowing unauthorized access.
Affects public-facing web applications and APIs.
Confirm if your WebSphere instances are impacted.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication in IBM WebSphere Application Server - Liberty when the saml-2.0 feature is enabled, potentially leading to unauthorized access and modification of sensitive information. This vulnerability is accessible over the network and does not require prior authentication or user interaction to trigger.

Requires saml-2.0 feature enabled.
Bypasses authentication controls.
Allows unauthorized access and data compromise.

Live Threat

Current exploitation, exposure, and threat context

When the samlWeb-2.0 feature is enabled, an authentication bypass vulnerability in IBM WebSphere Application Server could allow an unauthenticated attacker to gain unauthorized access to protected resources. This could impact system integrity and confidentiality by allowing access to data that should be restricted.

System authentication mechanisms
Unauthenticated network access
Unauthorized access to sensitive data

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability in IBM WebSphere Application Server affects deployments using the `samlWeb-2.0` feature. The first step is for infrastructure or platform teams to inventory all WebSphere Liberty instances, identify those with the `samlWeb-2.0` feature enabled, and confirm their external reachability and business criticality. This will enable the application owner or a designated security team to prioritize remediation efforts.

Application and platform teams own the issue.
Verify `samlWeb-2.0` feature and external exposure.
Plan risk-based remediation with the application owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server Liberty?

It is a lightweight, modular Java application server used to host web applications and APIs. Developers often use it to build and run microservices or enterprise-grade software. It includes various features that can be toggled on or off to provide specific services, such as identity management or connectivity, tailored to the requirements of the hosted application.

What does CVE-2026-93909 mean?

This vulnerability is an authentication bypass, categorized as CWE-384. Essentially, the software fails to properly manage or validate session identifiers during the authentication process. Because of this flaw, an attacker can trick the system into accepting an unauthorized request as if it came from a logged-in user, granting them access to protected resources without ever providing valid credentials.

How is this authentication bypass triggered?

The vulnerability is triggered when the samlWeb-2.0 feature is active on a WebSphere Liberty instance. An attacker sends specifically crafted network requests to the server to exploit the flaw. If this feature is disabled, the specific code path responsible for this bypass is not in use, meaning the server is not susceptible to this particular attack vector.

Do I need to worry about this if my server is internal?

Halo Surface Signal indicates that WebSphere instances using SAML are often positioned at the network edge to handle public identity traffic. While internet-facing instances are at the highest risk, internal systems might still be vulnerable if they are reachable by unauthorized users within your network. You should verify if your specific instances are accessible from outside your trusted zones.

How do I start addressing CVE-2026-93909?

Begin by auditing your environment to locate all WebSphere Liberty instances. Check the configuration of each instance to see if the samlWeb-2.0 feature is enabled. Once you have an inventory of affected servers, assess their network reachability and determine which systems hold the most sensitive data to prioritize your next steps for mitigation or updating the software.

References

www.ibm.com/support/pages/node/7292236

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.