Description

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T22:17:05.837Z",
  "pubdate": "2026-08-25T22:17:05.837Z",
  "executiveSummary": "An improper authentication vulnerability exists in Apache Tomcat where specific authentication mechanisms, such as CLIENT-CERT or SPNEGO, fail to correctly validate user existence within a configured DataSourceRealm.\nThis flaw allows unauthorized entities to bypass identity verification, potentially granting access to resources despite the absence of a corresponding entry in the configured security database.\nThe vulnerability impacts a broad range of versions across the 11.0.x, 10.1.x, 9.0.x, 8.5.x, and 7.0.x release branches.\nThe primary risk involves unauthorized authentication, which could lead to unauthorized data access or the escalation of privileges within the application environment.\nExploitation requires an attacker to interact with a Tomcat instance configured to utilize vulnerable authentication realms. No additional credentials are required, as the vulnerability resides in the core logic failure to perform mandatory lookup validations.",
  "technicalDetails": "The vulnerability stems from a flaw in how the DataSourceRealm implementation handles user authentication requests when utilizing specific security protocols like CLIENT-CERT (Certificate-based authentication) or SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism).\nUnder normal operating conditions, the DataSourceRealm is responsible for verifying that a presented identity exists within the backing data store before granting an authenticated session. The logic failure occurs because the authentication process fails to enforce the mandatory user existence check during the handshake or validation phase.\nIn the context of CLIENT-CERT authentication, the Tomcat container should validate the presented client certificate against the user database defined in the DataSourceRealm. Due to the identified flaw, the container logic incorrectly concludes that the authentication attempt is successful even if the underlying DataSourceRealm does not contain a record for the provided identity.\nSimilarly, when SPNEGO is employed, the mechanism intended to negotiate security tokens with the configured realm fails to verify the target user against the internal repository. Consequently, an attacker providing a validly formatted, yet non-existent, identity can trick the container into establishing an authenticated session.\nThe attack flow involves: 1) An attacker identifies a target Apache Tomcat instance utilizing a DataSourceRealm with CLIENT-CERT or SPNEGO enabled. 2) The attacker initiates an authentication handshake with credentials (or certificates) that are cryptographically valid but do not correspond to any defined user within the DataSourceRealm. 3) The Tomcat authentication logic processes the request and incorrectly treats the authentication as successful due to the missing lookup validation. 4) The server generates an authenticated session token for the non-existent user, granting the attacker access to resources protected by the security constraint associated with that realm.\nThis vulnerability is classified as an improper authentication issue. It undermines the integrity of the security realm, allowing bypass of identity management controls. The impact is significant as it effectively renders authentication mechanisms ineffective, enabling unauthorized access to protected web applications.\nAffected versions include: Apache Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. Furthermore, EOL versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are known to be affected, necessitating immediate migration or remediation for any remaining legacy deployments."
}