CVE-2026-95695: IBM WebSphere Liberty Auth Bypass Flaw

CVE-2026-95695 is an authentication bypass vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. Attackers can exploit incorrect authorization to bypass security. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-95695 Overview

IBM WebSphere Application Server Liberty contains an authorization bypass vulnerability affecting versions 20.0.0.12 through 26.0.0.10. A remote attacker can bypass security restrictions due to incorrect authorization logic in the application server runtime. The flaw is categorized under [CWE-863: Incorrect Authorization] and can be triggered over the network without authentication or user interaction. Successful exploitation impacts both confidentiality and integrity of protected resources served by the application server.

Critical Impact
Unauthenticated remote attackers can bypass authorization controls to access or modify protected resources hosted on affected WebSphere Liberty servers.

Affected Products

IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10
Applications relying on Liberty role-based access control for resource protection
Deployments exposing Liberty-managed endpoints to untrusted networks

Discovery Timeline

2026-10-13 - CVE-2026-95695 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-95695

Vulnerability Analysis

The vulnerability resides in the authorization decision path of IBM WebSphere Application Server Liberty. The server fails to correctly enforce access control checks, allowing requests that should be rejected to reach protected functionality. Because the issue affects authorization rather than authentication, attackers do not need valid credentials to abuse the flaw.

The advisory classifies the issue as high complexity, indicating that exploitation requires specific conditions in the request flow or configuration. However, no privileges or user interaction are required. Impact spans confidentiality and integrity, while availability is not directly affected.

Root Cause

The root cause is incorrect authorization [CWE-863]. Liberty evaluates access control decisions in a way that permits specific request patterns to bypass declared security constraints. The flaw affects a broad range of Liberty versions, suggesting a long-standing defect in a shared authorization code path rather than a regression in a single release.

Attack Vector

The attack vector is network-based. An attacker sends crafted requests to a Liberty endpoint protected by role-based or URL-based security constraints. If exploitation succeeds, the server processes the request as if the caller were authorized, exposing protected business logic, APIs, or administrative functions.

No verified proof-of-concept code is publicly available. Refer to the IBM Support Page for Node #7292228 for vendor-provided technical details.

Detection Methods for CVE-2026-95695

Indicators of Compromise

Successful HTTP responses (200, 201, 204) on protected Liberty endpoints without preceding authentication exchanges
Access log entries showing anonymous or unexpected principals invoking role-restricted URLs
Audit log gaps where authorization decisions are missing for sensitive resource requests

Detection Strategies

Compare request paths against the application's declared web.xml or server.xml security constraints and alert when protected paths are reached without a matching authenticated session
Inspect Liberty audit logs for SECURITY_AUTHZ events that return Granted for unauthenticated subjects
Baseline normal access patterns to administrative and API endpoints and alert on deviations

Monitoring Recommendations

Enable Liberty audit logging and forward events to a centralized analytics platform for correlation
Monitor outbound data volumes from Liberty hosts for signs of unauthorized data retrieval
Track configuration changes to server.xml security elements and application role mappings

How to Mitigate CVE-2026-95695

Immediate Actions Required

Inventory all IBM WebSphere Application Server Liberty instances and identify versions between 20.0.0.12 and 26.0.0.10
Apply the IBM-provided fix referenced in the vendor advisory as soon as it is validated in a staging environment
Restrict network exposure of Liberty management and application endpoints to trusted segments until patched

Patch Information

IBM has published remediation guidance on the IBM Support Page for Node #7292228. Administrators should follow the vendor's instructions for upgrading to a fixed Liberty release or applying the recommended interim fix.

Workarounds

Place affected Liberty instances behind a web application firewall configured to enforce authentication on protected paths
Review and tighten security-role and security-constraint definitions in deployed applications to reduce the reachable attack surface
Disable or isolate non-essential Liberty features and endpoints until the patch is deployed

bash

# Example: verify installed Liberty version before and after patching
${WLP_HOME}/bin/productInfo version

# Example: apply an IBM-provided fix pack using installUtility
${WLP_HOME}/bin/installUtility install <fix-pack-id>