The flaw arises when Tomcat’s CLIENT_CERT authentication fails to reject connections that should be denied, even when the soft‑fail option is disabled. This allows an attacker to present a malformed or otherwise invalid certificate that is mistakenly accepted, granting unauthorized access to protected resources. The weakness lies in the certificate validation logic, leading to an authentication bypass that can compromise confidential data and enable further exploitation.

Apache Tomcat versions 11.0.0‑M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121 are affected. Security updates that fix the issue are available in 11.0.26, 10.1.60, and 9.0.122.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker can remotely exploit the flaw by initiating TLS handshakes with crafted client certificates that meet the bypass conditions; network access to the Tomcat service and ability to present a client certificate are the primary prerequisites.