# CVE-2026-75973: Apache Tomcat improper authentication in Jakarta Authentication

Source: https://junglewise.ai/threats/cve-2026-75973-improper-authentication-vulnerability-in-apache-tomcat-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75973 · Severity: high · CVSS 7.3 · Published 2026-09-23

Apache Tomcat is an application server that runs web applications. When Jakarta Authentication is configured with SimpleAuthConfigProvider, the authentication realm of the first web application is incorrectly reused for all other web applications on the same server. An attacker could exploit this to access other users' accounts or data across different applications without proper authentication.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-75973 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75973 being exploited in the wild.

**How severe is CVE-2026-75973?** High severity, with a CVSS score of 7.3, published 23 September 2026.

**Which products and versions are affected?** Apache Tomcat 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, 11.0.0-M1 through 11.0.25.

**Is there a fix for CVE-2026-75973?** A patch was published on 2026-09-23: Fixed in versions 11.0.26, 10.1.60, 9.0.122 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75973 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75973?** Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authentication issue in Apache Tomcat's Jakarta Authentication implementation with SimpleAuthConfigProvider configured as the default provider. When multiple web applications use this provider, the authentication realm from the first application to process a request is reused for all subsequent authentication attempts across different applications, bypassing application-specific authentication contexts. This allows cross-context authentication bypass in multi-application deployments.

## Affected products

- Apache Tomcat 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, 11.0.0-M1 through 11.0.25

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 11.0.26, 10.1.60, 9.0.122

## References

- [https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr](https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr)
- [http://www.openwall.com/lists/oss-security/2026/09/23/20](http://www.openwall.com/lists/oss-security/2026/09/23/20)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)