CVE-2026-55957-PoC

This repository does not have a README...

Amazon Linux 2 : tomcat, --advisory ALAS2-2026-3864 (ALAS-2026-3864)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3864 advisory. Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds usi...

Important: tomcat

Issue Overview: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, fro...

TencentOS Server 4: tomcat (TSSA-2026:0738)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0738 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Apache Tomcat 9.0.0.M1 < 9.0.102

The version of Tomcat installed on the remote host is prior to 9.0.102. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.102security-9 advisory. - Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to...

Apache Tomcat 10.1.0.M1 < 10.1.39

The version of Tomcat installed on the remote host is prior to 10.1.39. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.39security-10 advisory. - Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to...

Fixed in Apache Tomcat 10.1.39

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password. This was fixed with commits 0cd21c03. This issue was reporte...

Fixed in Apache Tomcat 11.0.5

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password. This was fixed with commits fd96ab41. This issue was reporte...