- Description
- Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
- Source
- security@apache.org
- NVD status
- Analyzed
- Products
- tomcat
CVSS 3.1
- Type
- Secondary
- Base score
- 8.1
- Impact score
- 5.2
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
- security@apache.org
- CWE-287
- Hype score
- Not currently trending
Apache Tomcat fixed 11 vulnerabilities on August 25, 2026, including auth bypass (CVE-2026-68569) and HTTP/2 DoS flaws. Update to 11.0.25 now. #ApacheTomcat #CyberSecurity #CVE #DenialOfService #Infosec https://t.co/TokBGrUWC0
@Daily_CyberSec
26 Aug 2026
363 Impressions
0 Retweets
3 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨*CVE* CVE-2026-68569 Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user… https://t.co/AtCE6xFRez ----- Traducción: CVE-2026-68569 Vul… https://t.co/bYtskK
@infoflowcloud
25 Aug 2026
37 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B",
"versionEndIncluding": "7.0.109",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546",
"versionEndExcluding": "9.0.121",
"versionStartIncluding": "8.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA",
"versionEndExcluding": "10.1.58",
"versionStartIncluding": "10.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45",
"versionEndExcluding": "11.0.25",
"versionStartIncluding": "11.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]