The vulnerability arises when Tomcat’s client certificate authentication fails to reject connections that should be denied, even when the soft‑fail option is disabled. This flaw allows attackers to present a malformed or otherwise invalid certificate that is unknowingly accepted, providing unauthorized access to protected resources. The weakness lies in the certificate validation logic, resulting in an authentication bypass that can compromise confidentiality and enable further exploitation.

Apache Tomcat versions 11.0.0‑M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121 are affected. Security updates that fix the issue are available in 11.0.26, 10.1.60, and 9.0.122.

No CVSS score is listed, but the authentication bypass nature of the flaw places it in the high‑impact domain. EPSS data is missing, and the vulnerability is not present in the CISA KEV catalog, so the current exploitation probability remains unknown. Nonetheless, an attacker can remotely attempt to exploit the flaw by initiating TLS handshakes with crafted client certificates that meet the bypass conditions; network access to the Tomcat service and ability to present a client certificate are the primary prerequisites.