CVE-2026-75973
Apache Tomcat: cross-context authentication mix-up with Jakarta Authentication
Technology
Apache Tomcat
CVSS Score
7.3 / 10.0
Affected Versions
11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M4 to 9.0.121; end of life but known affected: 8.5.0 to 8.5.100
Upstream Fix
11.0.26; 10.1.60; 9.0.122
Published
September 23, 2026
OSSeva Coverage
Fixed upstream
Description
When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and several web applications used it, the realm of the first web application to authenticate a request was used for all of them. Made public on 23 September 2026 and rated Low by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M4 to 9.0.121; end of life but known affected: 8.5.0 to 8.5.100, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.25; 10.1.0-M1 to 10.1.59; 9.0.0.M4 to 9.0.121; end of life but known affected: 8.5.0 to 8.5.100?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?