Improper Authentication Vulnerability in Apache Tomcat by Apache

CVE-2026-75973

What is CVE-2026-75973?

An improper authentication issue has been identified in Apache Tomcat that occurs when Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider. This vulnerability leads to the realm for the first web application that authenticates a request being used across all web applications using that provider. Affected versions include Apache Tomcat 11.0.0-M1 to 11.0.25, 10.1.0-M1 to 10.1.59, and 9.0.0.M4 to 9.0.121, alongside EOL versions from 8.5.0 to 8.5.100. Users should upgrade to the latest versions 11.0.26, 10.1.60, or 9.0.122 to mitigate this risk.

References