CVE-2026-55957High· 7.3▾ MidnightPoC availableApache Tomcat has a Missing Critical Step in Authentication vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Nov 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
2.9%
1 GitHub repo (last check)
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.5org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.37org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.101org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100org.apache.tomcat.embed:tomcat-embed-core <= 7.0.109org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.5org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.37org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.101org.apache.tomcat:tomcat >= 8.5.0, <= 8.5.100org.apache.tomcat:tomcat <= 7.0.109org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.5org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.37org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.101org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100org.apache.tomcat:tomcat-catalina <= 7.0.109Upgrade to a patched release:
org.apache.tomcat.embed:tomcat-embed-core 11.0.5org.apache.tomcat.embed:tomcat-embed-core 10.1.37org.apache.tomcat.embed:tomcat-embed-core 9.0.101org.apache.tomcat:tomcat 11.0.5org.apache.tomcat:tomcat 10.1.37org.apache.tomcat:tomcat 9.0.101org.apache.tomcat:tomcat-catalina 11.0.5org.apache.tomcat:tomcat-catalina 10.1.37org.apache.tomcat:tomcat-catalina 9.0.101Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55956Medium· 6.5Apache Tomcat has an Improper Authorization vulnerability
CVE-2026-57915High· 7.3Apache Kerby has a bypass the Kerberos pre-authentication check
CVE-2026-40542High· 7.3Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification
CVE-2023-54391Critical· 9.8Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configure…
CVE-2026-119776Medium· 6.1frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
CVE-2026-77800High· 7.7Authentication bypass vulnerability