IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authorization bypass vulnerability identified as CVE-2026-16190. The vulnerability allows unauthorized users to bypass authorization controls. The CVSS v3.1 base score is 3.1, indicating a low severity impact with limited confidentiality impact and no integrity or availability impact. No patch or remediation information is currently provided.