CVE-2026-76183
Received Received - Intake

Authentication Bypass in Apache Tomcat WebSocket Endpoint

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-76183
EUVD
EUVD-2026-85225

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
apache tomcat From 11.0.0-M1 (inc) to 11.0.25 (inc)
apache tomcat From 10.1.0-M1 (inc) to 10.1.59 (inc)
apache tomcat From 9.0.0.M1 (inc) to 9.0.121 (inc)
apache tomcat From 8.5.0 (inc) to 8.5.100 (inc)
apache tomcat From 7.0.43 (inc) to 7.0.109 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows attackers to bypass authentication for WebSocket endpoints in Apache Tomcat. Security constraints meant to protect these endpoints can be ignored, potentially granting unauthorized access.

Detection Guidance

This vulnerability allows bypassing security constraints for WebSocket endpoints in Apache Tomcat. To detect it, check Tomcat version against affected ranges (11.0.0-M1 to 11.0.25, 10.1.0-M1 to 10.1.59, 9.0.0.M1 to 9.0.121, 8.5.0 to 8.5.100, 7.0.43 to 7.0.109). Use commands like 'catalina.sh version' or check server status pages for version info.

Impact Analysis

If exploited, attackers could access restricted WebSocket endpoints without proper authentication. This may lead to unauthorized data exposure, manipulation, or further network compromise depending on the application's use of WebSockets.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and authentication for sensitive data. Unauthorized access risks breaches of GDPR or HIPAA, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122 to fix the issue. If using unsupported versions like 8.5.x or 7.0.x, upgrade to a supported version or apply vendor patches immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart