CVE-2026-65905

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This allows the attacker to replay the request once, potentially bypassing authentication.

This Moderate impact flaw in Apache Tomcat's DIGEST authenticator allows a limited authentication bypass through a replay attack. While the attack complexity is high, a remote attacker could potentially replay a single authenticated request if the nonceCount is at the upper boundary of the replay window, leading to limited unauthorized access. This vulnerability affects configurations utilizing DIGEST authentication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable DIGEST authentication in Apache Tomcat if it is not a required authentication mechanism for your deployment. Refer to the Apache Tomcat documentation for guidance on configuring authentication methods. Disabling DIGEST authentication will affect services that depend on it. A restart of the Tomcat service is necessary for the configuration changes to be applied.