CVE-2026-65905

Analyzed Analyzed - Analysis Complete

Authentication Bypass via Replay Attack in Apache Tomcat

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-65905

EUVD

EUVD-2026-66128

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 8.5.0 (inc) to 9.0.121 (exc)
apache	tomcat	From 7.0.30 (inc) to 7.0.109 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This is an authentication bypass vulnerability in Apache Tomcat's DIGEST authenticator. It allows a client to replay a single authenticated request within a specific window of requests, potentially bypassing authentication checks.

Detection Guidance

This vulnerability is specific to Apache Tomcat's DIGEST authenticator and requires checking the Tomcat version and configuration. No direct detection commands are provided in the context. Verify Tomcat version with 'catalina.sh version' or check server.xml for DIGEST authenticator settings.

Impact Analysis

An attacker could exploit this to gain unauthorized access to protected resources by replaying a captured authenticated request. This could lead to data breaches or unauthorized actions on the server.

Compliance Impact

This vulnerability allows replay attacks on authentication requests, potentially granting unauthorized access to sensitive data. This could violate compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and protection of personal or health information.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121, which fix the issue. If using unsupported versions like 8.5.x or 7.0.x, upgrade to a supported version immediately.

Hi! I’m here to help you understand CVE-2026-65905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70