This vulnerability (CVE-2026-55955) in Apache Tomcat involves improper authentication (CWE-287) that enables a replay attack on the EncryptionInterceptor within the cluster component. The flaw affects multiple major release lines of Apache Tomcat, specifically versions 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.18, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109. The vendor has addressed the issue in versions 11.0.23, 10.1.56, and 9.0.119. The CVSS score of 6.5 reflects a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality and integrity but not availability.

An attacker can perform a replay attack against the EncryptionInterceptor in the cluster component of Apache Tomcat, potentially compromising authentication mechanisms. This could lead to unauthorized access or manipulation of cluster communication, impacting confidentiality and integrity of data. There is no indication of impact on availability. The vulnerability requires no privileges and no user interaction, making it remotely exploitable over the network.

Users should upgrade affected Apache Tomcat versions to 11.0.23, 10.1.56, or 9.0.119, where the vulnerability has been fixed. Patch status is confirmed by the vendor's recommended upgrade versions. No other mitigations or temporary fixes are indicated in the available data.