GHSA-H3X4-894J-XPX5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

🗓️ 26 Aug 2026 00:30:52Reported by GoogleType

osv🔗 osv.dev👁 35 Views

Apache Tomcat FORM authentication Incorrect Authorization bypasses POST-only constraints.

Reporter	Title	Published	Views	Family All 200
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	14 Oct 202606:16	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat11, tomcat11-admin-webapps, tomcat11-el-6.0-api (ALAS2023-2026-3151)	12 Oct 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)	11 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21811-1)	11 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21823-1)	12 Sep 202600:00	–	nessus
Tenable Nessus	RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.2.5 (RHSA-2026:73981)	1 Oct 202600:00	–	nessus
Tenable Nessus	RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)	7 Oct 202600:00	–	nessus
Tenable Nessus	SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:4114-1)	15 Sep 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-68525
github	www.github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8
github	www.github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43
github	www.github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098
github	www.github.com/apache/tomcat
lists	www.lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
openwall	www.openwall.com/lists/oss-security/2026/08/26/7

11 Sep 2026 08:25Current

7.8High risk

Vulners AI Score7.8

CVSS 3.19.1

EPSS0.00477

Apache Tomcat Incorrect Authorization FORM Authentication Security Constraint GET Bypass