CVE-2026-73180: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-73180 Overview

CVE-2026-73180 is an Insufficient Session Expiration vulnerability [CWE-613] in Apache Tomcat. The flaw affects how Tomcat manages WebSocket sessions tied to authenticated HTTP sessions. When the session ID of an authenticated HTTP session changes after a WebSocket connection has been established, Tomcat fails to close the associated WebSocket session when the HTTP session ends. This behavior violates the Jakarta WebSocket specification and leaves authenticated WebSocket connections active beyond their intended lifecycle. An attacker with valid low-privilege credentials could leverage this behavior to maintain access to WebSocket resources after the underlying HTTP session should have been terminated.

Critical Impact
WebSocket sessions remain active after the authenticated HTTP session ends, allowing continued access to protected resources and undermining session termination controls.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.0.M1 through 9.0.120
End-of-life versions known to be affected: 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109

Discovery Timeline

2026-08-25 - CVE-2026-73180 published to the National Vulnerability Database
2026-08-26 - Public notification posted to the Openwall oss-security mailing list
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-73180

Vulnerability Analysis

Apache Tomcat implements the Jakarta WebSocket specification, which requires WebSocket sessions established under an authenticated HTTP session to be closed when that HTTP session ends. CVE-2026-73180 breaks this guarantee in a specific scenario. When application code changes the HTTP session ID after a WebSocket connection has been established, Tomcat loses the association between the original HTTP session and the WebSocket session. When the HTTP session subsequently expires or is invalidated, the WebSocket session remains open. An attacker holding that WebSocket connection continues to interact with authenticated endpoints even though the HTTP session that authorized the connection no longer exists. This weakens logout, session timeout, and re-authentication controls that applications rely on for access management.

Root Cause

The root cause is an incorrect tracking of the HTTP session reference within the WebSocket session container after a session ID rotation. Session ID changes are commonly triggered by frameworks after authentication to prevent session fixation. Because Tomcat did not update the internal mapping between the rotated session and the previously established WebSocket, the lifecycle linkage required by [CWE-613] Insufficient Session Expiration was broken.

Attack Vector

Exploitation requires an authenticated user context and specific application behavior that changes the session ID after a WebSocket handshake completes. The attacker establishes a WebSocket connection under an authenticated HTTP session, triggers a session ID change, and then waits for the HTTP session to end through logout or timeout. The WebSocket remains usable, allowing continued access to messages, commands, or data streams the application exposes over WebSocket. The high attack complexity reflects the specific application preconditions required for the flaw to be reachable. See the Apache Mailing List Thread for the maintainers' description.

Detection Methods for CVE-2026-73180

Indicators of Compromise

WebSocket connections that remain active after the associated HTTP session has been invalidated or expired
WebSocket message activity from a client whose session cookie no longer authenticates against / protected endpoints
Discrepancies between HTTP access logs showing session termination and continued WebSocket traffic from the same client

Detection Strategies

Enable Tomcat access logging with session ID fields and correlate HTTP session termination events with WebSocket close events
Instrument application HttpSessionListener and Endpoint.onClose handlers to record session-to-WebSocket lifecycle mismatches
Review deployed applications for use of HttpServletRequest.changeSessionId() or framework equivalents that rotate session IDs after WebSocket setup

Monitoring Recommendations

Alert on WebSocket sessions that exceed the configured HTTP session timeout without a corresponding close frame
Track authentication and logout events, then verify WebSocket connections for the affected user are terminated within the expected window
Monitor Tomcat version inventory to identify hosts running affected 9.x, 10.1.x, or 11.0.x releases

How to Mitigate CVE-2026-73180

Immediate Actions Required

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121, which contain the fix
Retire any instances running end-of-life 7.0.x or 8.5.x releases and migrate workloads to a supported branch
Audit web applications for code paths that rotate session IDs after WebSocket handshakes and document exposure until patching is complete

Patch Information

The Apache Tomcat project addressed CVE-2026-73180 in versions 11.0.25, 10.1.58, and 9.0.121. Upgrade details and release notes are referenced in the Apache Mailing List Thread and the Openwall OSS-Security Update.

Workarounds

Application code can explicitly close active WebSocket sessions when handling logout or session invalidation events through an HttpSessionListener
Avoid changing the session ID while WebSocket connections are active, or close and re-establish WebSocket connections after session ID rotation
Reduce HTTP session timeout values to limit the window in which a stale WebSocket can remain useful

bash

# Example: enforce WebSocket close on session end via a listener registration in web.xml
<listener>
    <listener-class>com.example.security.WebSocketSessionCleanupListener</listener-class>
</listener>