External risk intelligence

Apache Tomcat FORM Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-68525

Apache Tomcat is a widely deployed web server and servlet container that is commonly exposed directly to the internet to host web applications and APIs. As the vulnerability resides within the FORM authentication process, which is a standard component for managing web-based user access, the affected surface is frequently reachable via public-facing network paths.

Apache Tomcat

7.0.0 to 7.0.1098.5.0 to before 9.0.12110.1.0 to before 10.1.5811.0.0 to before 11.0.25

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An incorrect authorization vulnerability has been identified in the FORM authentication process of Apache Tomcat, a widely used web server and servlet container. This issue could potentially allow unauthorized access to resources, bypassing security controls that distinguish between different HTTP methods like GET and POST.

Authentication bypass in Tomcat web servers.
Affects how users access web resources.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to a vulnerable Apache Tomcat server. This could allow them to bypass security restrictions, potentially gaining unauthorized access to resources that are normally protected.

Publicly accessible server required.
Malicious request triggers bypass.
Unauthorized access to protected resources.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Apache Tomcat's FORM authentication could allow unauthorized access to resources. Specifically, it might enable bypassing security constraints that differentiate between GET and POST requests for resource access, potentially exposing information or functionality intended for specific user roles.

Affected: Sensitive resources in Tomcat applications.
Exposure: Via specially crafted requests bypassing authentication.
Consequence: Unauthorized access to restricted resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in Apache Tomcat's FORM authentication process likely falls under the purview of platform or infrastructure teams responsible for web server management, with application owners needing to coordinate due to potential impact on hosted services. The initial practical step is to inventory all Tomcat instances, identify those exposed externally or hosting critical applications, and confirm the accountable owner before planning remediation.

Platform or application teams own remediation.
Verify external or business-critical instances.
Plan and coordinate necessary upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Tomcat?

Apache Tomcat is an open-source web server and servlet container used to run Java-based web applications. It acts as the engine that processes requests, manages sessions, and serves dynamic web content. It is a foundational piece of technology for many enterprise websites and back-end services, handling the communication between users and application logic.

How does CVE-2026-68525 work?

This vulnerability is an Incorrect Authorization flaw, classified as CWE-863. It specifically affects how Tomcat handles FORM-based authentication. The system fails to properly enforce security constraints that are intended to distinguish between different types of HTTP requests, such as allowing a GET request while blocking a POST request to the same resource. This flaw allows an unauthorized user to bypass these configured access controls.

What triggers this authentication bypass?

An attacker triggers this by sending a specially crafted request to an affected server. The bypass occurs because the server incorrectly validates authorization for specific request methods. Importantly, this is a logic flaw in the authentication process; it does not require the attacker to have valid credentials or perform complex system manipulation to influence the server's authorization decision.

Is my server at risk?

According to Halo Surface Signal, this vulnerability is highly relevant because Apache Tomcat is often deployed directly on the internet to host public-facing applications. Since the flaw exists within the standard FORM authentication process, any Tomcat instance accessible via public network paths is potentially reachable by an attacker attempting to bypass resource restrictions.

How do I respond to this vulnerability?

Your first step is to inventory your environment to identify all running instances of Apache Tomcat, focusing on those that are internet-facing or host sensitive applications. Once identified, coordinate with the appropriate infrastructure or application owners to schedule an upgrade to the patched versions—11.0.25, 10.1.58, or 9.0.121—which resolve the authorization bypass.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.