Improper Authentication in Apache Tomcat’s EncryptionInterceptor in the cluster component permits a replay of previously captured encrypted messages, allowing an attacker to impersonate a legitimate node or client. This flaw violates proper authentication controls (CWE-287) and lacks replay protection mechanisms (CWE-294). The effect is that an attacker may gain unauthorized access to inter‑node communication, potentially escalating privileges and compromising the confidentiality and integrity of the cluster environment.

The vulnerability affects Apache Tomcat versions ranging from 7.0.100 to 7.0.109, 8.5.38 to 8.5.100, 9.0.13 to 9.0.18, 10.1.0‑M1 to 10.1.55, and 11.0.0‑M1 to 11.0.22. Ongoing support indicates that upgrading to 11.0.23, 10.1.56, or 9.0.119 resolves the issue; versions for the 8.5 and 7.x lines are not listed in the advisory.

The CVSS score of 6.5 denotes a moderate to high risk. The EPSS score of < 1% indicates a low probability of exploitation in the wild, but the flaw is not present in the CISA KEV catalog. An attacker would need network access to the Tomcat cluster, the ability to intercept or fabricate encrypted cluster traffic, and sufficient time to replay a captured message. If successful, they could impersonate a node and inject malicious data, elevating the impact of the attack.