Amazon Linux 2 : tomcat (ALAS-2026-4089)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4089 advisory. A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI...

BIT-TOMCAT-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0 through 11.0.26,...

PT-2026-132482

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0 through 11.0.26,...

SUSE CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

Linux Distros Unpatched Vulnerability : CVE-2026-101296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism...

Missing Critical Step in Authentication

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the JNDIRealm authentication process when configured with a non-GSSAPI SASL mechanism. An attacker can gain unauthoriz...

DEBIAN-CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

EUVD-2026-105010

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296

A missing verification step in Apache Tomcat allows an unauthenticated remote attacker to bypass authentication when the JNDI realm is configured with a non-GSSAPI SASL mechanism. This flaw enables unauthorized access to protected resources by allowing authentication without a correct password. A...

tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm

A flaw was found in Apache Tomcat. When the Java Naming and Directory Interface JNDI realm is configured with a non-Generic Security Service Application Program Interface GSSAPI Simple Authentication and Security Layer SASL mechanism, a missing verification step allows an attacker to bypass...

PT-2026-118373

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.26 Apache Tomcat versions 10.1.0-M1 through 10.1.60 Apache Tomcat versions 9.0.0.M1 through 9.0.122 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

Red Hat: CVE-2026-101296: tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm

A flaw was found in Apache Tomcat. When the Java Naming and Directory Interface JNDI realm is configured with a non-Generic Security Service Application Program Interface GSSAPI Simple Authentication and Security Layer SASL mechanism, a missing verification step allows an attacker to bypass...