CVE-2026-76183

A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potentially leading to sensitive information disclosure or other unauthorized actions.

This vulnerability is rated as having an Important severity because unauthenticated remote attackers can circumvent access control constraints protecting WebSocket endpoints, posing significant risks to application data confidentiality and integrity. The issue specifically impacts Red Hat Enterprise Linux and JBoss Web Server environments where deployed applications configure container-managed security restrictions on WebSocket communication channels. Standard HTTP endpoints and applications that do not utilize WebSocket functionality remain unaffected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.