An improper authentication flaw in Apache Tomcat can cause an attacker to be authenticated even when the user does not exist in the DataSourceRealm. This flaw allows a client to obtain authentication credentials for non‑existent users, effectively granting unauthorized access to protected resources. The weakness is classified as a CWE‑287 authentication bypass and also maps to CWE‑305, indicating an additional weakness related to improper restriction of operations within the bounds of a memory buffer.

Apache Software Foundation’s Apache Tomcat is affected in all major releases from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, and from 9.0.0.M1 through 9.0.120. End‑of‑life versions from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109 are also known to be affected, and other unsupported versions may be vulnerable.

The vulnerability requires the ability to interact with Tomcat over a network using authentication mechanisms such as CLIENT‑CERT or SPNEGO, making it exploitable from a remote location. The CVSS score is 8.1, indicating high severity, while the EPSS score shows a very low yet non‑zero exploitation probability (<1 %). The issue is not listed in CISA’s KEV catalog, but the potential for authentication bypass in a widely deployed web server warrants a moderate to high risk assessment. Attackers could exploit this flaw to gain unauthorized access to data or services hosted on Tomcat.