EUVD-2026-25131
GHSA-r6x6-g36w-q7qm
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
AnalysisAI
Identity spoofing in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.4 allows authenticated attackers with low privileges to impersonate other users and escalate privileges when applications are deployed without proper authentication and authorization controls. The vulnerability requires high attack complexity and low-privilege credentials, but enables complete compromise of confidentiality, integrity, and availability within the application scope. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all IBM WebSphere Application Server Liberty deployments and identify instances running versions 17.0.0.3 through 26.0.0.4. Within 7 days: Apply IBM vendor-released patch to all affected Liberty instances; consult IBM advisory for specific remediation version numbers. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today