CVE-2026-55957

The record

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-77800 ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML… CWE-304
• CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass… CWE-304
• CVE-2026-76207 phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where… CWE-304
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-304
• CVE-2026-61466 In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server… CWE-304
• CVE-2026-67351 Serendipity before 2.6.1 contains an authentication context confusion vulnerability where… CWE-304
• CVE-2026-61143 Vulnerability in the Oracle Communications Convergent Charging Controller product of… CWE-304
• CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending… CWE-304