CVE-2025-66614
Improper Input Validation in Apache Tomcat Enables Auth Bypass
Publication date: 2026-02-17
Last updated on: 2026-03-11
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | From 10.1.1 (inc) to 10.1.50 (exc) |
| apache | tomcat | From 11.0.1 (inc) to 11.0.15 (exc) |
| apache | tomcat | From 9.0.1 (inc) to 9.0.113 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Input Validation issue in Apache Tomcat versions from 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112, as well as some older EOL versions. The problem occurs because Tomcat does not verify that the host name provided via the TLS Server Name Indication (SNI) extension matches the host name provided in the HTTP host header field.
If Tomcat is configured with multiple virtual hosts and the TLS configuration for one host does not require client certificate authentication while another does, an attacker can bypass client certificate authentication by sending different host names in the SNI extension and the HTTP host header.
This vulnerability only applies if client certificate authentication is enforced at the Connector level, not if it is enforced at the web application level.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass client certificate authentication in Apache Tomcat when multiple virtual hosts are configured with differing TLS client certificate requirements.
By exploiting the mismatch between the SNI extension and the HTTP host header, an attacker can access resources or services that should require client certificate authentication without providing a valid certificate.
This could lead to unauthorized access to sensitive parts of a web application or server, potentially compromising security controls that rely on client certificate authentication.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Tomcat to version 11.0.15 or later, 10.1.50 or later, or 9.0.113 or later, which fix the issue.
The vulnerability only applies if client certificate authentication is enforced at the Connector level. It does not apply if client certificate authentication is enforced at the web application level.