Improper Authentication in the EncryptionInterceptor of Apache Tomcat allows an attacker to replay previously captured encrypted cluster messages, thereby bypassing authentication and potentially gaining unauthorized access or escalating privileges within the cluster. This flaw is understood as a violation of proper authentication controls (CWE-287) and compromises the confidentiality and integrity of inter‑node communications.

Affected Apache Tomcat versions range from 7.0.100 to 7.0.109, 8.5.38 to 8.5.100, 9.0.13 to 9.0.18, 10.1.0 to 10.1.55, and 11.0.0 to 11.0.22. The vulnerability resides in the cluster component’s EncryptionInterceptor.

The lack of replay protection means an attacker who can observe or inject traffic in a Tomcat cluster can replay an encrypted message to impersonate a legitimate node or client. While EPSS data is not available, the vulnerability is classified as an authentication bypass, a high‑risk flaw. The attack vector would involve network access to the cluster, and it would likely require the attacker to capture existing encrypted messages or forge them. The risk remains significant until patched, yet the vulnerability is not listed in the CISA KEV catalog.