In LockOutRealm, user names are treated case‑sensitively, which constitutes a CWE‑178 vulnerability and deviates from typical authentication behavior. When a user logs in with a name differing only in case, the system may accept it as a distinct account or fail to reject an already locked account properly. This flaw can allow an attacker to bypass account lockout policies or create duplicate user identities, thereby compromising authentication integrity.

Apache Tomcat supplied by Apache Software Foundation is impacted across multiple major branches: tomcat 11 from 11.0.0‑M1 to 11.0.21, 10.1 from 10.1.0‑M1 to 10.1.54, 9.0 from 9.0.0.M1 to 9.0.117, 8.5 from 8.5.0 to 8.5.100, and 7.0 from 7.0.0 to 7.0.109. Unsupported older releases may also be affected.

The CVSS score and EPSS are not provided, and the vulnerability is not listed in the CISA known exploited vulnerabilities catalog. Without an explicit public exploit, the probability of immediate exploitation remains unclear, but attackers able to manipulate case in usernames could gain unauthorized access or weaken locking mechanisms. The likely attack vector is via the application’s login interface; no elevated privileges or remote code execution are reported.