Vulnerability Report

CVE-2026-55957

Title: Missing Critical Step in Authentication

Other

Proof Of Concept

PoC Available for CVE-2026-55957

CWE Category CWE-304

Published Date Jun 29, 2026

Modified Date Jul 02, 2026

Exploit Status Available

Score 7.3 CVSS v

Exploit Probability (EPSS)

2.86%

Vulnerability Summary

CVE-2026-55957: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Impacted Vendors

apache 1

Reference Links

https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

7.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-55957 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/mdvpat/CVE-2026-55957-PoC

View Code

July 02, 2026 MODIFIED

Vulnerability data updated via NVD.

June 30, 2026 MODIFIED

Vulnerability data updated via NVD.

June 29, 2026 MODIFIED

Vulnerability data updated via NVD.

June 29, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected Stack

No specific products linked.