Apache Tomcat up to 11.0.4 critical step in authentication

Summaryinfo

A vulnerability described as critical has been identified in Apache Tomcat up to 11.0.4. This issue affects some unknown processing. Such manipulation leads to critical step in authentication. This vulnerability is listed as CVE-2026-55957. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache Tomcat up to 11.0.4. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a critical step in authentication vulnerability. Using CWE to declare the problem leads to CWE-304. The product implements an authentication technique, but it skips a step that weakens the technique. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

The weakness was presented by Ilan Toyter. The advisory is shared for download at lists.apache.org. This vulnerability is handled as CVE-2026-55957 since 06/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/30/2026).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40233). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 6.x
• 7.0.109
• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5.100
• 9.0
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion