CVE-2026-68525: Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.25 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.58 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.121
Event History
Frequently Asked Questions
Which deployments are exposed to this authorization bypass?
Deployments using Apache Tomcat FORM authentication are exposed when a security constraint permits POST access to a resource but denies GET access. The affected supported release ranges are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120.
What access condition makes exploitation possible?
The vulnerable condition requires a resource with method-specific authorization where a user is allowed to POST but not GET, together with Tomcat FORM authentication. Under those conditions, the FORM authentication redirect can bypass the GET restriction.
What versions fix the issue?
Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121. Older EOL versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also known to be affected; other unsupported versions may be affected as well.