CVE-2026-68525: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-68525 Overview

CVE-2026-68525 is an authorization bypass vulnerability in Apache Tomcat's FORM authentication process. Attackers can bypass security constraints that restrict a user's access to a resource by HTTP method. Specifically, when a constraint permits POST but denies GET, an attacker can circumvent that restriction. The flaw is tracked under CWE-863: Incorrect Authorization and affects multiple supported and end-of-life Tomcat branches. Apache has released fixed versions 11.0.25, 10.1.58, and 9.0.121 to address the issue.

Critical Impact
Remote, unauthenticated attackers can bypass method-based security constraints in Tomcat applications using FORM authentication, gaining access to protected resources.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.0.M1 through 9.0.120 (also EOL branches 8.5.0–8.5.100 and 7.0.0–7.0.109)

Discovery Timeline

2026-08-25 - CVE-2026-68525 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-68525

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's FORM-based authentication handler. Tomcat evaluates security constraints defined in web.xml to decide whether a request is permitted based on the authenticated user, role, and HTTP method. When a constraint restricts a resource so a user can POST but not GET, Tomcat's FORM authentication flow fails to correctly enforce the method restriction.

An attacker can leverage this gap to reach resources that should be blocked for GET requests. Because FORM authentication is widely deployed for Java web applications, the affected surface is broad. Successful exploitation compromises confidentiality and integrity of resources that rely on method-scoped constraints for access control.

Root Cause

The root cause is incorrect authorization logic (CWE-863) in the FORM authenticator. The authenticator does not correctly evaluate the HTTP method against the matched security constraint after the authentication step. As a result, a request that should have been denied based on the method is instead permitted once the session is authenticated.

Attack Vector

Exploitation occurs over the network without user interaction and does not require prior privileges. An attacker crafts an HTTP request against a resource protected by a FORM-authenticated Tomcat application. By using the HTTP method combination the constraint intended to block, the attacker bypasses the constraint and accesses the restricted resource.

The vulnerability is described in prose only; no verified proof-of-concept code is provided in the referenced advisories. See the Apache Mailing List Thread and the Openwall OSS Security Update for advisory details.

Detection Methods for CVE-2026-68525

Indicators of Compromise

Unexpected HTTP GET requests succeeding against resources that should only accept POST for a given user role.
Access log entries showing authenticated sessions retrieving resources outside their normal method scope.
Repeated requests toggling HTTP methods against the same protected URL from a single client.

Detection Strategies

Compare request method distributions in Tomcat access logs against declared <http-method> constraints in web.xml.
Alert on 200-status responses to GET requests targeting URLs where the security constraint permits only POST.
Correlate FORM authentication events (j_security_check) with subsequent access to method-restricted paths.

Monitoring Recommendations

Ingest Tomcat access_log and catalina.out into a centralized log platform for constraint-based analytics.
Baseline normal method usage per authenticated role and alert on deviations.
Monitor for scanner-like patterns that enumerate HTTP methods against authenticated endpoints.

How to Mitigate CVE-2026-68525

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121 depending on the deployed branch.
Retire end-of-life Tomcat 7.x and 8.5.x instances or migrate them to a supported, patched branch.
Inventory web applications that rely on FORM authentication with method-scoped security constraints.

Patch Information

Apache Tomcat maintainers released fixed versions 11.0.25, 10.1.58, and 9.0.121. Details are published in the Apache Mailing List Thread and the Openwall OSS Security Update.

Workarounds

Replace method-based deny constraints with explicit application-layer checks that validate HTTP method for every request.
Front Tomcat with a reverse proxy or web application firewall that enforces method restrictions on protected paths.
Switch affected applications from FORM authentication to an alternative authenticator until patches are applied.

bash

# Configuration example
# Verify installed Tomcat version and plan upgrade
$CATALINA_HOME/bin/version.sh

# After upgrading, confirm the fixed version is running
# Expected: Server number: 11.0.25 / 10.1.58 / 9.0.121