An authentication layer confusion occurs when Jakarta Authentication is configured with the SimpleAuthConfigProvider as the default provider and several web applications share that provider. The realm that authenticates the first application a request hits is then reused for all other applications. This flaw effectively bypasses authentication boundaries, allowing an attacker who can authenticate to one application to obtain authorized access to any other application that shares the same provider. The weakness maps to CWE‑287 – Improper Authentication.

Apache Software Foundation’s Tomcat server is impacted across several major branches. Versions affected include 8.5.0 through 8.5.100 (all EOL), 9.0.0.M4 through 9.0.121, 10.1.0.M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Users are advised to upgrade to at least 11.0.26, 10.1.60, or 9.0.122, which contain the fix.

Although EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the CVSS score of 7.3 indicates moderate severity, and the potential impact is significant because it grants cross‑application authentication. Attackers can exploit the flaw remotely by sending standard HTTP requests to a Tomcat instance where Jakarta Authentication is active and multiple applications are configured to share the default provider. Successful exploitation requires that the configuration uses the default SimpleAuthConfigProvider; no elevated privileges are necessary on the host, making the risk high for any exposed application. The lack of a current EPSS score does not diminish the relevance of this flaw when the described configuration is in use.