Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

🗓️ 26 Aug 2026 00:30:52Reported by GitHub Advisory DatabaseType

Incorrect Authorization in Apache Tomcat FORM auth bypasses POST-only security constraints.

Reporter	Title	Published	Views	Family All 200
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	14 Oct 202606:16	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat11, tomcat11-admin-webapps, tomcat11-el-6.0-api (ALAS2023-2026-3151)	12 Oct 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)	11 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21811-1)	11 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21823-1)	12 Sep 202600:00	–	nessus
Tenable Nessus	RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.2.5 (RHSA-2026:73981)	1 Oct 202600:00	–	nessus
Tenable Nessus	RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)	7 Oct 202600:00	–	nessus
Tenable Nessus	SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:4114-1)	15 Sep 202600:00	–	nessus

Vulners

Node

org.apache.tomcat.embed tomcat-embed-coreRange7.0.0–7.0.109maven

org.apache.tomcat.embed tomcat-embed-coreRange8.5.0–8.5.100maven

org.apache.tomcat.embed tomcat-embed-coreRange9.0.0-M1–9.0.121maven

org.apache.tomcat.embed tomcat-embed-coreRange10.1.0-M1–10.1.58maven

org.apache.tomcat.embed tomcat-embed-coreRange11.0.0-M1–11.0.25maven

org.apache.tomcat tomcat-catalinaRange7.0.0–7.0.109maven

org.apache.tomcat tomcat-catalinaRange8.5.0–8.5.100maven

org.apache.tomcat tomcat-catalinaRange9.0.0-M1–9.0.121maven

org.apache.tomcat tomcat-catalinaRange10.1.0-M1–10.1.58maven

org.apache.tomcat tomcat-catalinaRange11.0.0-M1–11.0.25maven

org.apache.tomcat tomcatRange7.0.0–7.0.109maven

org.apache.tomcat tomcatRange8.5.0–8.5.100maven

org.apache.tomcat tomcatRange9.0.0-M1–9.0.121maven

org.apache.tomcat tomcatRange10.1.0-M1–10.1.58maven

org.apache.tomcat tomcatRange11.0.0-M1–11.0.25maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-68525
lists	www.lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7
openwall	www.openwall.com/lists/oss-security/2026/08/26/7
github	www.github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8
github	www.github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43
github	www.github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-h3x4-894j-xpx5

02 Sep 2026 22:39Current

7.8High risk

Vulners AI Score7.8

CVSS 3.19.1

EPSS0.00477

SSVC

CWE-863