CVE-2026-101294: IBM WebSphere Application Server cryptographic signature verification bypass

CVE-2026-101294 · Severity: high · CVSS 8.7 · Published 2026-10-13

IBM WebSphere Application Server and WebSphere Application Server Liberty are application server platforms that run enterprise Java applications. A missing cryptographic step allows remote attackers to bypass signature verification on security tokens used in authentication and authorization decisions, potentially leading to account takeover or privilege escalation without requiring valid credentials.

Technologies: IBM WebSphere Application Server, IBM WebSphere Application Server Liberty. Vendors: IBM.

Quick answers

Is CVE-2026-101294 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101294 being exploited in the wild.
How severe is CVE-2026-101294?
High severity, with a CVSS score of 8.7, published 13 October 2026.
Which products and versions are affected?
IBM WebSphere Application Server 8.5, 9.0; IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10.
Is there a fix for CVE-2026-101294?
Yes: fixed in WebSphere Application Server Liberty 26.0.0.11 or later (with Interim Fix DT502997 available earlier); WebSphere Application Server 9.0.5.30 or later (with Interim Fix DT503882 available earlier); WebSphere Application Server 8.5.5.32 or later (with Interim Fix DT503882 available earlier). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101294 attacked?
It is attacked over the network.
Am I affected by CVE-2026-101294?
Check whether you run IBM WebSphere Application Server or IBM WebSphere Application Server Liberty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: WebSphere Application Server Liberty 26.0.0.11 or later (with Interim Fix DT502997 available earlier); WebSphere Application Server 9.0.5.30 or later (with Interim Fix DT503882 available earlier); WebSphere Application Server 8.5.5.32 or later (with Interim Fix DT503882 available earlier)

Technical details

A missing cryptographic step vulnerability (CWE-325) in the signature verification logic allows remote attackers with no privileges or user interaction to bypass cryptographic signature verification. The vulnerability affects Liberty's OpenID Connect and JWT token validation features, as well as traditional WebSphere Application Server. An attacker can forge or tamper with security tokens that are not properly verified, gaining unauthorized access.

Affected products

  • IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10
  • IBM WebSphere Application Server 8.5, 9.0

Timeline

  • 2026-10-13: disclosed
  • 2026-10-15: advisory: Updated to clarify affected Liberty features

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.