The vulnerability originates from a flaw in client‑certificate validation during OCSP checks. When the server is configured with OCSP soft‑fail disabled, it sometimes still accepts certificates that should be rejected, allowing an attacker to authenticate with a forged or otherwise invalid certificate. This bypass can grant unauthorized access to protected resources and elevate privileges, representing a critical authentication failure.

Affected software includes Apache Tomcat versions 11.0.0‑M1 through 11.0.18, 10.1.0‑M7 through 10.1.52, and 9.0.83 through 9.0.115. Apache Tomcat Native is vulnerable in versions 1.1.23 through 1.1.34, 1.2.0 through 1.2.39, 1.3.0 through 1.3.6, and 2.0.0 through 2.0.13. Upgrading to Tomcat 11.0.20, 10.1.53, or 9.0.116, and to Tomcat Native 1.3.7 or 2.0.14 resolves the issue.

The risk is high because the flaw directly undermines authentication, a foundational security control. No CVSS or EPSS score is available, but the absence from KEV indicates it has not yet been widely exploited. The attack vector is inferred to be a TLS connection using client certificates; if an attacker supplies a certificate that passes a failed OCSP check, the server may incorrectly accept it. Therefore, exploitation requires the ability to present a client certificate to the server, which is typically limited to systems with certificate‑based authentication enabled.