Cross-Application Authentication Bypass in Apache Tomcat
CVSS 3.1
7.3high
EPSS
—
Published
()
Modified
AI analysis
This is an improper authentication vulnerability in Apache Tomcat. It occurs when Jakarta Authentication is configured with SimpleAuthConfigProvider as the default and multiple web applications use that provider; the security realm from the first application to authenticate a request is incorrectly applied to all subsequent applications. This allows an attacker to gain unauthorized access to a different web application's resources by triggering authentication in the intended application first. The flaw affects multiple supported and end-of-life Tomcat versions. There is no known public proof-of-concept or in-the-wild exploitation at this time.
What to do: Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122, depending on your current major version line. If you cannot upgrade immediately, ensure your web applications do not rely on the SimpleAuthConfigProvider or evaluate alternative authentication configurations. Review your Jakarta Authentication setup to confirm that the intended security realm is correctly applied to each application.
Affected
Apache Tomcat
from 11.0.0-M1 through 11.0.25
Apache Tomcat
from 10.1.0-M1 through 10.1.59
Apache Tomcat
from 9.0.0.M4 through 9.0.121
Apache Tomcat
from 8.5.0 through 8.5.100 (EOL)
Estimated exposure
massPotentially >100,000 deployments, as Tomcat is a foundational component in countless enterprise and cloud environments. — The exposure estimate is based on the widespread deployment of Apache Tomcat as a major Java application server and web container across the internet.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat 11.0.26, dated September 15, 2026, fixes 12 vulnerabilities that were publicly disclosed on September 23. CVE-2026-76183, rated Important, can bypass security constraints on WebSocket endpoints in every 11.0 build from 11.0.0-M1 through 11.0.25. The release also fixes WebSocket and AJP denial-of-service flaws, including CVE-2026-78383 and CVE-2026-77791, and an HTTP/2 request-header mix-up tracked as CVE-2026-86350. Apache does not ship binary patches and advises upgrading from 11.0.25 or earlier.
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
Apache released Tomcat 11.0.26 on September 23, 2026, fixing 12 vulnerabilities across WebSocket, HTTP/2, AJP, authentication, and TLS validation. Four are rated Important, three Moderate, and five Low; most affect 11.0.0-M1 through 11.0.25. CVE-2026-87022 can smuggle WebSocket messages when per-message-deflate is enabled, and CVE-2026-86350 can mix up HTTP/2 request headers. CVE-2026-76183 is an Important WebSocket authorization bypass. Apache advises upgrading to 11.0.26; no exploitation is reported.
Low-severity Tomcat CVE-2026-75973 can mix authentication across apps using Jakarta Authentication.
Mark Thomas disclosed CVE-2026-75973, a low-severity improper authentication flaw in Apache Tomcat. When Jakarta Authentication uses SimpleAuthConfigProvider as the default provider and multiple web applications use that configuration, cross-context authentication mix-up is possible. Affected lines include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M4 through 9.0.121, and 8.5.0 through 8.5.100. Tomcat through 7.0.109 is unaffected, and no exploitation is reported.