Description
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.



The following versions were EOS at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.




Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Published: 2026-09-23
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Upgrade
AI Analysis

Impact

An authentication bypass flaw allows an attacker to circumvent the security constraints applied to WebSocket endpoints in Apache Tomcat. The vulnerability permits the use of alternate names to reach protected endpoints, effectively granting unauthorized access and the ability to read, modify, or inject traffic through the WebSocket channel.

Affected Systems

Apache Tomcat, versions 7.0.43 to 7.0.109, 8.5.0 to 8.5.100, 9.0.0.M1 to 9.0.121, 10.1.0-M1 to 10.1.59, and 11.0.0-M1 to 11.0.25 are affected. The End‑of‑Support releases 8.5.0–8.5.100 and 7.0.43–7.0.109 are also known to be vulnerable.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in CISA KEV catalog, but the CVSS score of 9.8 indicates critical severity. Attackers could use the WebSocket handshake to gain unauthorized access without credentials. The combination of an authentication bypass and WebSocket exposure indicates a significant risk of confidentiality and integrity compromise.

Generated by OpenCVE AI on September 23, 2026 at 17:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Apache Tomcat release (11.0.26, 10.1.60, or 9.0.122) to address the authentication bypass for WebSocket endpoints.
  • If you cannot upgrade immediately, restrict direct access to WebSocket endpoints using firewall rules or network segmentation to limit exposure.
  • Reconfigure or audit security constraints in your web.xml or application configuration to ensure WebSocket endpoints are protected with proper authentication.

Generated by OpenCVE AI on September 23, 2026 at 17:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 23 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 23 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache tomcat
Vendors & Products Apache
Apache tomcat

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Title Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Weaknesses CWE-289
References

Subscriptions

Apache Tomcat
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-09-30T14:54:21.515Z

Reserved: 2026-08-19T10:37:56.319Z

Link: CVE-2026-76183

cve-icon Vulnrichment

Updated: 2026-09-23T18:10:41.803Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T12:17:06.537

Modified: 2026-09-30T15:22:34.470

Link: CVE-2026-76183

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-23T11:16:09Z

Links: CVE-2026-76183 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T18:00:07Z

Weaknesses
  • CWE-289

    Authentication Bypass by Alternate Name