Improper Authentication in Apache Tomcat - CVE-2026-75973
Published: September 23, 2026
Vulnerability identifier: #VU151848
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-75973
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause authentication to use another web application's realm.
The vulnerability exists due to improper isolation of authentication realms in Jakarta Authentication when multiple web applications use SimpleAuthConfigProvider as the default provider. A remote user can authenticate to a web application to cause authentication to use another web application's realm.
Authentication uses the realm of the first web application to authenticate a request.
Affected software
Apache Tomcat
How to mitigate CVE-2026-75973
Install security update from vendor's website.
Apache Tomcat - addressed in versions 9.0.122, 10.1.60, 11.0.26