CVE-2026-75973 in Tomcat
Summary
by MITRE • 09/23/2026
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified as Improper Authentication in Apache Tomcat represents a critical flaw within the Jakarta Authentication subsystem when utilizing the SimpleAuthConfigProvider configuration mode. This security defect arises from an architectural oversight where authentication realms are not properly isolated between distinct web applications deployed on the same server instance. In a multi-tenant or multi-application environment, each web application is typically expected to maintain its own independent set of credentials and access control policies defined by its specific realm configuration. However, under the affected conditions, the Tomcat container fails to scope the authentication context correctly, leading to a shared state that persists across different applications rather than remaining confined to the individual application's namespace.
The technical root cause lies in how the SimpleAuthConfigProvider manages session and request attributes during the authentication process. When this provider is set as the default for Jakarta Authentication, it incorrectly reuses the realm instance associated with the first web application that successfully authenticates a user or processes an initial request. Consequently, any subsequent requests from other web applications are evaluated against the credentials and permissions of that initially authenticated application's realm. This behavior effectively bypasses the intended isolation boundaries between applications, allowing users to leverage authentication tokens or session data established for one context to gain access in another unrelated context where they should not have been authorized.
The operational impact of this vulnerability is severe, particularly in environments hosting multiple independent web applications on a single Tomcat instance. An attacker who can authenticate against the first application could potentially exploit the shared realm state to access resources in other deployed applications without possessing valid credentials for those specific targets. This constitutes a horizontal privilege escalation and a breach of confidentiality across application boundaries. The vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-16, Configuration Errors, due to the misconfiguration or default behavior that permits cross-application context leakage. From an ATT&CK perspective, this flaw facilitates lateral movement within a compromised environment and can be leveraged for unauthorized access to sensitive data stored in other applications, mapping closely to techniques involving credential reuse and session hijacking mechanisms.
The scope of this issue is broad, affecting Apache Tomcat versions from 11.0.0-M1 through 11.0.25, version 10.1.0-M1 through 10.1.59, and version 9.0.0.M4 through 9.0.121. Additionally, legacy versions ranging from 8.5.0 to 8.5.100 are known to be vulnerable despite having reached end-of-life status at the time of disclosure. Other unsupported releases may also exhibit this behavior due to shared codebases and architectural similarities in earlier iterations of the Jakarta Authentication implementation. The persistence of this flaw across multiple major release lines underscores a systemic issue in how authentication contexts were historically managed within the Tomcat ecosystem when using specific configuration providers.
To mitigate this risk, organizations running affected versions must upgrade immediately to patched releases that correct the realm isolation logic. Specifically, users should migrate to Apache Tomcat version 11.0.26, 10.1.60, or 9.0.122, depending on their current deployment baseline. These updated versions implement proper scoping mechanisms ensuring that authentication realms remain strictly bound to the web application context in which they were initialized. For environments unable to upgrade immediately due to compatibility constraints, administrators should consider disabling SimpleAuthConfigProvider as the default provider and switching to alternative authentication configurations that do not exhibit this cross-application state sharing behavior. Additionally, implementing strict network segmentation between applications can provide a layer of defense-in-depth, although it does not replace the need for patching the underlying software defect. Regular auditing of deployed web application configurations is also recommended to ensure no other instances of improper context isolation exist within the infrastructure.