The vulnerability arises when Apache Tomcat’s FFM connector is configured with an invalid certificate revocation list, but the system fails to abort processing or take remedial action. This flaw allows a malicious actor to supply a forged or expired client certificate that would normally be detected, enabling impersonation or unauthorized access to protected resources. The weakness is a classic case of detection of an error condition without subsequent handling, a type of flaw listed as CWE‑390.

Systems running Apache Tomcat versions 11.0.0‑M1 through 11.0.22, 10.1.0‑M7 through 10.1.55, or 9.0.83 through 9.0.118 are affected. The issue is specific to Tomcat releases.

Based on the available metrics, the vulnerability has a CVSS score of 9.1, indicating high severity. The EPSS score of < 1% (0.00174) suggests that the exploitation probability is low but not zero. The vulnerability is not listed in the CISA KEV catalog. The lack of failure on CRL errors means that an attacker can potentially bypass revocation checks without detection. Based on the description, it is inferred that an attacker could trigger the flaw by sending a request with an invalid or missing CRL to the FFM connector. The attack could be performed either locally or remotely depending on the exposure of the connector, and no additional authentication or privileged access appears to be required. This flaw permits revocation checks to be bypassed, enabling potential credential forgery and unauthorized data access.