CVE-2026-75973

This is an improper authentication vulnerability in Apache Tomcat. It occurs when Jakarta Authentication is configured with SimpleAuthConfigProvider as the default and multiple web applications use that provider; the security realm from the first application to authenticate a request is incorrectly applied to all subsequent applications. This allows an attacker to gain unauthorized access to a different web application's resources by triggering authentication in the intended application first. The flaw affects multiple supported and end-of-life Tomcat versions. There is no known public proof-of-concept or in-the-wild exploitation at this time.

What to do: Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122, depending on your current major version line. If you cannot upgrade immediately, ensure your web applications do not rely on the SimpleAuthConfigProvider or evaluate alternative authentication configurations. Review your Jakarta Authentication setup to confirm that the intended security realm is correctly applied to each application.