IBM WebSphere Application Server Liberty SAML 2.0 authentication bypass (CVE-2026-93909)

What happened

IBM WebSphere Application Server Liberty has an authentication bypass in its samlWeb-2.0 feature. When that feature is enabled, an attacker who can reach the server over a network can bypass SAML authentication without credentials and without any user action. The flaw is rated 9.1 critical under CVSS 3.1, with high impact to confidentiality and integrity; availability is not affected.

The weakness is recorded as CWE-384, session fixation. In practice, applications and sessions protected by SAML single sign-on should be treated as reachable by an unauthenticated attacker until the fix is applied. The CVE record does not list active exploitation or a CISA KEV entry.

Who is affected

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10, when the samlWeb-2.0 feature is enabled. Liberty is a Java application server commonly used to host web applications, and the SAML 2.0 feature is enabled for federated single sign-on. If samlWeb-2.0 is not enabled, the version range alone does not place the deployment in the affected set.

What to do now

1. Identify every Liberty instance in the affected version range and confirm whether samlWeb-2.0 is enabled.
2. Apply IBM's fix. The CVE record indicates a fix is available but does not list the exact fixed version; confirm it from IBM's support page.
3. If patching must be delayed, restrict network access to affected Liberty servers, especially SAML endpoints, and treat existing SSO sessions as untrusted until the fix is in place.
4. Review authentication logs and changes to high-privilege accounts for unexpected activity.

How to detect it

IBM has not published indicators of compromise for this issue in the sources used. Review Liberty authentication and SSO logs for new or unexpected SAML sessions, logins from unfamiliar IP addresses, and changes to high-privilege accounts, since the flaw permits unauthenticated access to protected functions.

Beyond the patch

This is a network-reachable authentication bypass, so the first question is whether any affected Liberty instance is exposed to the internet or an untrusted segment — Virtual CISO Services (vCISO) is built to find that exposure before an attacker does. Once authentication has been bypassed, the attacker's subsequent access and credential misuse show up in EDR and SIEM signals, which Managed Detection & Response (MDR) is designed to detect and respond to. Keeping an inventory of WebSphere versions and IBM's patch record across the estate belongs in Supply Chain Defense & Third-Party Risk, because the vendor's patch cycle is your exposure window.