The vulnerability arises when Apache Tomcat’s FFM connector is configured with an invalid certificate revocation list, but the system fails to abort processing or take remedial action. This flaw allows a malicious actor to supply a forged or expired client certificate that would normally be detected, enabling impersonation or unauthorized access to protected resources. The weakness is a classic case of detection of an error condition without subsequent handling, a type of flaw listed as CWE‑390.

Systems running Apache Tomcat versions 11.0.0‑M1 through 11.0.22, 10.1.0‑M7 through 10.1.55, or 9.0.83 through 9.0.118 are affected. The issue is specific to the FFM based connector component within these Tomcat releases.

While no current exploitation metrics (EPSS) are available and the vulnerability is not in CISA’s KEV catalog, the lack of failure on CRL errors means that an attacker can potentially bypass revocation checks without detection. The attack vector is local or remote depending on the deployment of the FFM connector, and no authentication or privileged access is required to trigger the flaw. The CVSS score is not provided, but administrators should treat this as a higher‑severity issue because it permits credential forgery and could result in unauthorized data access.