CVE-2026-68525: Apache Tomcat Critical Authorization Bypass Vulnerability
Summary
CVE-2026-68525: Apache Tomcat: Redirect after FORM auth may bypass method specific constraints. Affects tomcat across 3 version ranges.
>= 7.0.0, < 9.0.121
>= 10.1.0, < 10.1.58
>= 11.0.0, < 11.0.25
Fixed in 9.0.121, 10.1.58 or 11.0.25, depending on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat · Maven
The same CVE-2026-68525 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for web applications. However, certain versions of Tomcat are vulnerable to an authorization bypass issue that can compromise application security.
Vulnerability Detail
The vulnerability arises from an incorrect authorization mechanism in Apache Tomcat's FORM authentication process. This flaw allows attackers to bypass security constraints that restrict access to resources based on HTTP methods, specifically allowing unauthorized access to resources that should only be accessible via POST requests. This could lead to unauthorized data exposure or manipulation, significantly impacting application integrity and confidentiality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 9.0.1219.0.121 -
>= 10.1.0, < 10.1.5810.1.58 -
>= 11.0.0, < 11.0.2511.0.25
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional access controls at the application level to restrict access to sensitive resources until they can upgrade to a secure version of Tomcat.
Conclusion
CVE-2026-68525 represents a significant security risk for users of affected versions of Apache Tomcat. It is crucial for users to upgrade to the latest patched versions to protect their applications from potential exploitation. Implementing workarounds can provide temporary relief, but a full upgrade is the best long-term solution.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-68525 is a critical vulnerability in Apache Tomcat that allows unauthorized access to resources due to an incorrect authorization mechanism in the FORM authentication process.
Affected versions include Apache Tomcat from 11.0.0 through 11.0.24, 10.1.0 through 10.1.57, and 9.0.0 through 9.0.120. Older versions, such as 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109, are also impacted.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check if your application is affected by CVE-2026-68525.
Exploitation of this vulnerability can lead to unauthorized access to sensitive resources, potentially resulting in data breaches or manipulation of application data.
If immediate upgrading is not possible, implement additional access controls at the application level to mitigate the risk of unauthorized access until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
