CVE-2026-65905: CWE-294 Authentication Bypass by Capture-replay in Apache Software Foundation Apache Tomcat
Description
CVE-2026-65905 is a critical authentication bypass vulnerability in Apache Tomcat's DIGEST authenticator. It allows replaying a DIGEST authenticated request once if the nonceCount is at the upper boundary of the replay window before windowSize requests have been made. This affects multiple Apache Tomcat versions from 7.0.30 through 11.0.24 and some earlier unsupported versions. The issue is fixed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
CVSS v3.1
Score 9.8critical
Affected software
Apache Software Foundation
Apache Tomcat
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Apache Tomcat's DIGEST authenticator (CWE-294) permits an attacker to bypass authentication by replaying a DIGEST authenticated request once if the nonceCount is at the upper boundary of the replay window before the windowSize number of requests have been made. The flaw affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120, as well as older unsupported versions 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109. The vulnerability is addressed in versions 11.0.25, 10.1.58, and 9.0.121.
Potential Impact
Successful exploitation allows an attacker to bypass authentication controls by replaying a DIGEST authenticated request, potentially leading to unauthorized access with full confidentiality, integrity, and availability impact as indicated by the CVSS score of 9.8 (critical).
Mitigation Recommendations
Users should upgrade Apache Tomcat to versions 11.0.25, 10.1.58, or 9.0.121 or later, which contain fixes for this vulnerability. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-23T12:14:17.351Z
- State
- PUBLISHED
Threat ID: 6a8e123aacd9273b49c467fd
Added to database: 08/25/2026, 22:07:54 UTC
Last enriched: 09/09/2026, 20:52:30 UTC
Last updated: 10/09/2026, 18:48:22 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.