CVE-2026-75973

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.0.M4 through 9.0.121 Apache Tomcat versions 8.5.0 through 8.5.100

Description An improper authentication issue exists when Jakarta Authentication is configured using SimpleAuthConfigProvider as the default provider across multiple web applications. In this scenario, the realm used by the first web application to authenticate a request is incorrectly applied to all other web applications.

Recommendations Upgrade to version 11.0.26 Upgrade to version 10.1.60 Upgrade to version 9.0.122 Restrict the use of SimpleAuthConfigProvider as the default provider when multiple web applications are deployed.