A high-severity authentication flaw in Apache Tomcat allows unauthorized users to gain access, potentially leading to significant compromise of application resources.

This is an improper authentication vulnerability (CWE-287) occurring within the DataSourceRealm. It allows an authenticated user to bypass existence checks during the authentication process when using CLIENT-CERT or SPNEGO mechanisms.

The vulnerability carries a CVSS score of 8.1, reflecting a high potential for unauthorized access and data manipulation. Successful exploitation grants attackers the ability to act as authenticated entities, which can lead to the theft of sensitive data, unauthorized execution of administrative functions, and a loss of trust in the integrity of the application environment.

Immediate Action: Upgrade to Apache Tomcat versions 11.0.25, 10.1.58, or 9.0.121 to resolve this vulnerability. For EOL versions 8.5.x and 7.0.x, users should migrate to a supported version immediately as no patches will be provided for those releases.

Proactive Monitoring: Review application access logs for unusual login patterns or authentication requests originating from unexpected sources. Monitor the DataSourceRealm for failed or irregular credential validation attempts.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected services using network-level controls or a Web Application Firewall (WAF) to filter traffic. Ensure that authentication configurations are audited and restricted to the minimum required scope.

Public Exploit Available: No

This vulnerability presents a clear risk to authentication integrity within the Apache Tomcat ecosystem. Organizations running affected versions must prioritize the upgrade to the specified fixed versions to eliminate this risk. Given the potential for unauthorized access, immediate action is required to ensure that only legitimate, verified users can interact with your application services.