Description

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.   This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T22:17:05.303Z",
  "pubdate": "2026-08-25T22:17:05.303Z",
  "executiveSummary": "A capture-replay vulnerability exists within the DIGEST authenticator mechanism of Apache Tomcat, stemming from improper management of the nonceCount replay window.\nThis vulnerability allows an attacker to replay a valid, previously intercepted DIGEST-authenticated request under specific conditions, effectively bypassing authentication protections.\nThe flaw affects multiple branches of Apache Tomcat, specifically 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, and various EOL versions including 8.5.x and 7.0.x.\nThe risk implication is significant as it permits unauthorized access to protected resources without requiring valid credentials for the replayed request.\nExploitation requires an attacker to intercept a legitimate client request and time the replay such that the nonceCount aligns with the upper boundary of the configured replay window before the windowSize threshold is exceeded.\nThis vulnerability is strictly limited to configurations utilizing the DIGEST authentication mechanism.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic governing the replay window validation for the DIGEST authentication scheme in Apache Tomcat. DIGEST authentication utilizes a nonce (number used once) and a nonceCount (nc) to prevent replay attacks by tracking the sequence of requests from a client.\nUnder normal operations, the server maintains a sliding window of allowed nonceCounts to account for out-of-order delivery or network latency. The vulnerability manifests when a client submits a request with a nonceCount positioned at the absolute upper boundary of the active replay window, specifically occurring before the windowSize number of requests has been satisfied.\nIn this precise state, the server's validation logic fails to correctly invalidate or track the nonce usage, allowing the same request to be reprocessed successfully by the DIGEST authenticator. Consequently, an attacker capable of capturing the network traffic between the client and the server can re-inject the captured DIGEST header and payload, and the server will treat it as a legitimate, authenticated request.\nThe attack flow follows a structured sequence: First, the attacker intercepts a valid DIGEST-authenticated request through network reconnaissance or man-in-the-middle positioning. Second, the attacker monitors the client's subsequent traffic to identify when the current nonceCount nears the upper limit of the window. Third, the attacker transmits the captured request during the narrow temporal and sequence-based window where the server logic is susceptible. If successful, the server processes the replayed request as if it originated from the legitimate user, granting the attacker the permissions associated with the user's session.\nThe vulnerable component is the DIGEST authentication valve/authenticator within the Tomcat web server architecture. Because this happens at the authentication layer, the impact is a complete bypass of identity verification for the specific request. This does not require prior privilege escalation; it relies solely on the ability to capture and replay a valid transaction. The vulnerability is network-exposed, meaning any service exposed via DIGEST authentication over HTTP/HTTPS is potentially at risk.\nAffected versions include 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. Older, unsupported versions such as 8.5.0-8.5.100 and 7.0.30-7.0.109 are also confirmed to be vulnerable, demonstrating a long-standing logic flaw in the implementation of the RFC-compliant DIGEST authentication mechanism."
}