Zhang Yilin

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.0.M1 through 9.0.121 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109 **Description** An authentication bypass exists when accessing WebSocket endpoints via an alternate name. This flaw allows security constraints to be bypassed, enabling unauthorized access to protected WebSocket endpoints. **Recommendations** Upgrade to version 11.0.26 Upgrade to version 10.1.60 Upgrade to version 9.0.122 At the moment, there is no information about a newer version that contains a fix for this vulnerability for versions 8.5.x and 7.0.x.