CVE-2026-75973: Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
Low-severity Tomcat CVE-2026-75973 can mix authentication across apps using Jakarta Authentication.
Mark Thomas disclosed CVE-2026-75973, a low-severity improper authentication flaw in Apache Tomcat. When Jakarta Authentication uses SimpleAuthConfigProvider as the default provider and multiple web applications use that configuration, cross-context authentication mix-up is possible. Affected lines include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M4 through 9.0.121, and 8.5.0 through 8.5.100. Tomcat through 7.0.109 is unaffected, and no exploitation is reported.
- Vendor rates the improper-authentication issue low
- Occurs when SimpleAuthConfigProvider is the default Jakarta Authentication provider
- Multiple web applications can share that provider and mix up authentication
- Tomcat through 7.0.109 is listed as unaffected
- CVEs
- CVE-2026-75973
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75973 | Cross-Application Authentication Bypass in Apache Tomcat | 7.3 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.