A missing authentication step in Apache Tomcat’s JNDIRealm allows an attacker to bind using GSSAPI without providing a valid password. This flaw results in the ability to gain authenticated access to the application, potentially exposing confidential data and allowing further attack development. The weakness is identified as CWE-304, an information exposure issue stemming from improper credential verification.

Apache Tomcat versions from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109 are affected. These include all releases from Tomcat 7 to the latest 11.x.

The vulnerability is exploitable over the network once the JNDIRealm is configured to use GSSAPI authenticated binds, with the attacker able to impersonate any user without providing a password. The CVSS score of 7.3 indicates a high severity, and the EPSS score of < 1% shows a low probability of exploitation. The lack of a KEV listing suggests no known public exploits at the time of this analysis. Given the high CVSS score, the flaw enables unauthenticated access to application resources, making it a serious security risk whenever the affected feature is enabled.