IBM WebSphere Liberty CVE-2026-93909

Exploitation requires that the target IBM WebSphere Application Server Liberty instance (versions 17.0.0.3 through 26.0.0.10) has the samlWeb-2.0 feature explicitly enabled in its server configuration to provide SAML 2.0 web single sign-on - this is an opt-in feature, not a default, so deployments without SAML SSO configured are not affected. Per the supplied CVSS vector the network path needs no attacker authentication or privileges (PR:N) and no user interaction (UI:N); however, because the underlying weakness is CWE-384 Session Fixation, realistic exploitation typically depends on a legitimate user subsequently authenticating via SAML against an attacker-influenced session, which is a practical limiting factor defenders should weigh against the raw vector. Patch level of the running Liberty instance also limits exposure.

This is a high-priority vulnerability on technical merits. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity authentication bypass requiring no privileges and no user interaction, yielding high confidentiality and integrity impact - consistent with an attacker gaining access to protected resources as another principal. However, several real-world risk signals are MISSING from the input and must not be assumed: no EPSS score is provided, there is no CISA KEV listing, and no proof-of-concept or exploit code is referenced, so exploitation is 'no public exploit identified at time of analysis.' A notable tension exists between the CVSS vector and the vulnerability nature: CWE-384 (Session Fixation) and the 'Session Fixation' tag typically require tricking or waiting for a legitimate user to authenticate against an attacker-influenced session identifier, which in practice often implies some victim interaction - yet the vector states UI:N. This should be verified against the IBM advisory, as it materially affects whether exploitation is fully unauthenticated-and-automatable or requires a victim to log in. Additionally, exploitation is gated on the samlWeb-2.0 feature being enabled, which is a non-default deployment condition that narrows the exposed population below the raw 9.1 severity.

An attacker targets an internet-facing IBM WebSphere Liberty server that has the samlWeb-2.0 SAML single sign-on feature enabled, and abuses the authentication/session handling flaw to bypass authentication and obtain access as a legitimate user without valid credentials. Given CWE-384 (Session Fixation), the attacker likely plants or fixes a session identifier and then leverages a victim's subsequent SAML login to hijack that authenticated session. No public exploit code is referenced in the provided data.