CVE-2026-15412 describes an open redirect vulnerability in IBM WebSphere Application Server 9.0, 8.5, and Liberty. An attacker can craft a URL that appears legitimate but redirects victims to malicious sites, facilitating phishing attacks. The vulnerability arises from improper validation of URLs used in redirects, allowing attackers to spoof trusted URLs and deceive users.

Successful exploitation could allow attackers to redirect users to malicious websites that appear trusted, potentially leading to disclosure of sensitive information or enabling additional attacks against victims. The CVSS 3.1 base score is 6.5 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of suspicious URLs and consider implementing web application firewall rules or URL validation controls to mitigate open redirect risks.