Apache Tomcat up to 9.0.105/10.1.41/11.0.7 authentication bypass

Summaryinfo

A vulnerability, which was classified as critical, has been found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7. Affected is an unknown function. Performing a manipulation results in authentication bypass. This vulnerability was named CVE-2025-49125. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7. This affects an unknown functionality. The manipulation with an unknown input leads to a authentication bypass vulnerability. CWE is classifying the issue as CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

The weakness was presented by Greg K. It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-49125 since 06/02/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/22/2025).

The vulnerability scanner Nessus provides a plugin with the ID 240060 (Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.106, 10.1.42 or 11.0.8 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240060), EUVD (EUVD-2025-18406) and CERT Bund (WID-SEC-2025-1335). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• Xerox FreeFlow Print Server
• Hitachi Ops Center
• Apache Tomcat
• Atlassian Jira
• Absolute Secure Access
• Red Hat JBoss Web Server
• Open Source Camunda
• Dell PowerProtect Data Domain
• HCL Commerce
• IBM Integration Bus
• Atlassian Bitbucket
• SAS Institute Base SAS
• Dell Secure Connect Gateway
• Dell NetWorker

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 9.0.105
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 10.1.40
• 10.1.41
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion