CVE-2026-75973
tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration
Severity
LowRed Hat Product Security
CVSS
Review impact separately from score.
Published · September 23, 2026
Updated · October 8, 2026
Description
A flaw was found in Apache Tomcat. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications utilize it, an improper authentication vulnerability arises. This issue causes the authentication realm established for the first web application to be incorrectly applied to all subsequent web applications. Consequently, this could lead to unauthorized access or incorrect authorization decisions across different web applications.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-305 · Authentication Bypass by Primary Weakness