CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Tomcat CVE-2026-76183 lets attackers bypass security constraints on any WebSocket endpoint.
Mark Thomas disclosed CVE-2026-76183, rated important, an Authentication Bypass by Alternate Name in Apache Tomcat. Security constraints on any WebSocket endpoint can be bypassed. Affected ranges are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109, plus releases before 7.0.43. The post does not report active exploitation.
- Important-severity authentication bypass of WebSocket security constraints
- Affects Tomcat 7.0.43–7.0.109, 8.5, 9.0, 10.1, and 11.0 through listed builds
- Disclosed by Mark Thomas; no exploitation reported
- CVEs
- CVE-2026-76183
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76183 | Critical Authentication Bypass in Apache Tomcat WebSocket Endpoints | 9.8 | <1% | PoC |
From the original article
Posted by Mark Thomas on Sep 23 Severity: important Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.