A critical authentication bypass vulnerability in Apache Tomcat allows unauthenticated attackers to perform replay attacks, risking full system compromise.

This is an Authentication Bypass by Capture-replay (CWE-294) flaw within the DIGEST authenticator. An unauthenticated attacker can replay a previously captured DIGEST-authenticated request if the nonceCount falls within a specific boundary of the replay window.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk level. Successful exploitation permits unauthorized access to sensitive application functions, potentially leading to total system compromise, data theft, or service disruption. Given that this affects the core authentication mechanism, the business impact is severe for any organization relying on DIGEST authentication for secure access control.

Immediate Action: Upgrade to Apache Tomcat version 11.0.25, 10.1.58, or 9.0.121 immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web server access logs for anomalous request patterns or multiple identical requests originating from the same session context that might indicate replay attempts.

Compensating Controls: If patching is not immediately feasible, consider disabling DIGEST authentication in favor of more secure alternatives, or implement strict network-level access controls to limit exposure to untrusted sources.

Public Exploit Available: False

This vulnerability represents a critical risk to infrastructure security due to the potential for complete authentication bypass. Administrators must prioritize upgrading their Apache Tomcat instances to the versions specified above. Failure to remediate this flaw exposes the application environment to unauthorized access and potential data breaches.