CVE-2021-30640: Authentication Bypass by Alternate Name in Apache Tomcat
Summary
CVE-2021-30640: Authentication Bypass by Alternate Name in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 8.5.0, < 8.5.65
>= 9.0.0M1, < 9.0.45
>= 10.0.0-M1, < 10.0.5
Fixed in 8.5.65, 9.0.45 or 10.0.5, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-30640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The JNDI Realm in Apache Tomcat is responsible for authenticating users based on their credentials stored in a directory server. However, a vulnerability in the JNDI Realm allows an attacker to bypass authentication using variations of a valid username and/or bypass some of the protection provided by the LockOut Realm.
Vulnerability Detail
The vulnerability in Apache Tomcat allows an attacker to bypass authentication by exploiting the JNDI Realm. By using alternate names or variations of a valid username, an attacker can gain unauthorized access to the system. This can lead to various security risks, such as unauthorized data access, privilege escalation, and potential system compromise. The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, and 8.5.0 to 8.5.65.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.658.5.65 -
>= 9.0.0M1, < 9.0.459.0.45 -
>= 10.0.0-M1, < 10.0.510.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the JNDI Realm and use an alternative authentication mechanism. This can be achieved by modifying the Tomcat configuration file (server.xml) and commenting out or removing the JNDI Realm configuration. However, this workaround should only be considered as a temporary solution, and upgrading to the latest version is strongly recommended.
Conclusion
The vulnerability in Apache Tomcat allows an attacker to bypass authentication and gain unauthorized access to the system. It is crucial to upgrade to the latest version of Apache Tomcat to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
The JNDI Realm in Apache Tomcat is responsible for authenticating users based on their credentials stored in a directory server.
The vulnerability allows an attacker to bypass authentication and gain unauthorized access to the system, leading to potential security risks such as unauthorized data access and system compromise.
The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, and 8.5.0 to 8.5.65.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Tomcat.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
