The issue lies in OCSP handling for client‑certificate authentication in Apache Tomcat and its native library. When OCSP soft‑fail is disabled, the validation routine may allow certain certificates that should fail, causing the authentication process to succeed even though the certificate is not trusted. This flaw effectively bypasses client‑side authentication, enabling an attacker to present a forged or expired certificate and gain authorized access to protected applications. The result can be disclosure of confidential data, modification of data, or denial of services that rely on proper client authentication.

Affected products are Apache Tomcat versions 9.0.83 through 9.0.115, 10.1.0‑M7 through 10.1.52, and 11.0.0‑M1 through 11.0.18. Apache Tomcat Native is vulnerable in versions 1.1.23 through 1.1.34, 1.2.0 through 1.2.39, 1.3.0 through 1.3.6, and 2.0.0 through 2.0.13. The vendor has released fixes in Tomcat 9.0.116, 10.1.53, and 11.0.20, and Tomcat Native 1.3.7 and 2.0.14.

The CVSS score is 9.1, indicating high severity. EPSS is under 1 %, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur over a publicly reachable network where the server is configured for client‑certificate authentication with OCSP soft‑fail disabled; an attacker could craft a request with a manipulated certificate chain to trigger the bypass. Because the flaw is purely in verification logic, no additional privileges are required beyond the ability to send a request to the affected server.