Apache Tomcat previously performed an incomplete credential validation when the JNDI realm was configured to use a non‑GSSAPI SASL authentication mechanism. This missing step allowed an attacker to bind successfully without supplying the correct password, effectively bypassing authentication. The flaw permits an attacker to impersonate any user whose account is configured in the realm, potentially gaining full access to sensitive application data and control.

The vulnerability applies to all supported releases of Apache Tomcat from version 9.0.0.M1 through 9.0.122, 10.1.0-M1 through 10.1.60, and 11.0.0-M1 through 11.0.26. Earlier end‑of‑life releases such as 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also affected, and other unsupported versions may be vulnerable. The issue is addressed in Tomcat 11.0.27, 10.1.61, and 9.0.123.

Based on the description, it is inferred that the flaw is remotely exploitable via an external JNDI request. The CVSS score is 9.1, and the EPSS score is unavailable, but the absence of containment measures indicates a high risk for systems exposed to hostile networks. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly disclosed exploits exist yet, yet attackers could exploit it by enabling non‑GSSAPI SASL mechanisms in a JNDI realm to bypass authentication and potentially control the application.