IBM WebSphere Application Server versions 9.0 and 8.5 have a log injection vulnerability via crafted LTPA token cookies. This vulnerability allows an attacker to inject malicious content into logs but does not impact confidentiality or availability. The CVSS score is low, reflecting limited impact and high attack complexity.