Loading vulnerability…
Method-Specific Authorization Bypass in Apache Tomcat FORM Authentication
CVE-2026-68525 is an incorrect authorization vulnerability in Apache Tomcat's FORM authentication process. A redirect following FORM authentication can bypass HTTP-method-specific security constraints when a requester is permitted to access a resource using POST but not GET, enabling unauthorized resource access. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also affected; other unsupported versions may be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses intended method-specific authorization and permits access to protected application resources through GET despite a constraint denying that access. Depending on application behavior and the resources exposed, this can disclose sensitive information or enable unauthorized modification. The CVSS v3 assessment assigns high confidentiality and integrity impact and no availability impact; it does not establish arbitrary code execution.
If you can’t patch tonight, do this now.
Until patched, review FORM-authenticated applications for constraints permitting POST while denying GET to the same resource. Enforce the intended method-specific authorization independently at the application or reverse-proxy layer where feasible. Restrict network access to affected applications using segmentation and access controls. These compensating controls do not replace the security update.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121, or a later fixed release in the corresponding branch. Migrate affected Tomcat 7.0 and 8.5 deployments to a supported fixed branch. For vendor-packaged or embedded Tomcat, install the applicable vendor security update rather than relying solely on the upstream version number. Identified fixed downstream releases include Confluence 9.2.26, 10.2.19, and 11.0.0, and Red Hat JBoss Web Server 6.2.5 and 7.0.2.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.