CVE-2026-55957CWE-304

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

High · published June 29, 2026

CVSS v3.1
7.3
EPSS
3%
Percentile
86.6
In the wild
Unconfirmed
What it is

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02855 · 86.6th percentile
Weakness
CWE-304 · Missing Critical Step in Authentication
Published
2026-06-29T20:47Z
EPSS history
Timeline
  • 29 JUN 20:47Z
    Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
    cvelistv5