Apache Tomcat can fail to reject certain client certificates when soft‑fail is disabled and the Fallback‑First‑Mechanism (FFM) is active. The server may accept an invalid or forged certificate and still establish an authenticated session, effectively bypassing the intended security control. This weakness is a classic authentication bypass, corresponding to CWE‑287, and is further aggravated by incorrect handling of configuration settings (CWE‑303).

The issue affects Apache Tomcat versions 11.0.0‑M14 through 11.0.20, 10.1.22 through 10.1.53, and 9.0.92 through 9.0.116. All milestone releases of 11.0.0 from M14 to M26 are also impacted. Users running any of these releases should verify whether client‑certificate authentication is enabled and whether FFM is in use.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an exploit likelihood of less than 1 %. It is not listed in the known exploited vulnerabilities catalog and no public exploits are reported. Attackers would need the ability to initiate an HTTPS connection with client‑certificate authentication enabled and supply a certificate that triggers the flawed verification logic. While the risk remains moderate, timely remediation is recommended.