Vulnerability GHSA-c5ph-rghf-fjfj
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 29, 2026 at 09:32 PM UTC
Apache Tomcat has an Improper Authentication vulnerability
7.0.100 - 7.0.109 and 8.5.38 - 8.5.100 and 9.0.13 - 9.0.118 and 10.1.0-M1 - 10.1.55 and 11.0.0-M1 - 11.0.22
7.0.100 - 7.0.109 and 8.5.38 - 8.5.100 and 9.0.13 - 9.0.118 and 10.1.0-M1 - 10.1.55 and 11.0.0-M1 - 11.0.22
Summary
Apache Tomcat has an Improper Authentication vulnerability
Details
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.118, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.35 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.35 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
7.0.35 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-gcx9-497g-6cp6
7.0.35 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-gcx9-497g-6cp6
Critical
2 months ago
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
7.0.35 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-h3x4-894j-xpx5
7.0.35 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-h3x4-894j-xpx5
Medium Risk
4 months ago
Apache Tomcat has an Improper Authorization vulnerability
7.0.35 - 7.0.109 and 8.5.0 - 9.0.118 and 10.1.0-M1 - 10.1.55 and 11.0.0-M1 - 11.0.22 GHSA-5v3h-fjv2-54fg
7.0.35 - 7.0.109 and 8.5.0 - 9.0.118 and 10.1.0-M1 - 10.1.55 and 11.0.0-M1 - 11.0.22 GHSA-5v3h-fjv2-54fg
High Risk
4 months ago
Apache Tomcat has a Missing Critical Step in Authentication vulnerability
7.0.35 - 7.0.109 and 8.5.0 - 9.0.100 and 10.1.0-M1 - 10.1.36 and 11.0.0-M1 - 11.0.4 GHSA-7895-gffq-w6jq
7.0.35 - 7.0.109 and 8.5.0 - 9.0.100 and 10.1.0-M1 - 10.1.36 and 11.0.0-M1 - 11.0.4 GHSA-7895-gffq-w6jq
Impacted packages
Timeline
Published
4 months ago
June 29, 2026 at 09:32 PM UTC
Fixed (11.0.23)
Unknown
Unknown
Fixed (10.1.56)
Unknown
Unknown
Fixed (9.0.119)
Unknown
Unknown
Fixed (11.0.23)
Unknown
Unknown
Fixed (10.1.56)
Unknown
Unknown
Fixed (9.0.119)
Unknown
Unknown
Last Modified
4 hours ago
November 04, 2026 at 04:55 PM UTC