This vulnerability involves session fixation via the Apache Tomcat rewrite valve. When enabled, an attacker can craft a URL that forces a victim's session to be associated with the attacker's session ID. This allows the attacker to hijack the victim's session and perform actions on their behalf. The issue affects Red Hat Hardened Images RPMs for tomcat11 components. Red Hat's advisory (RHSA-2026:6569) confirms the vulnerability and notes that no suitable mitigation or fix is currently available that meets their standards. The vulnerability is tracked under CVE-2025-55668 and is part of a group of related CVEs addressed in the advisory.

Successful exploitation allows an attacker to hijack a victim's session by fixing the session ID via a crafted URL when the rewrite valve is enabled in Apache Tomcat. This compromises session confidentiality and allows unauthorized actions within the victim's session context. There is no impact on integrity or availability reported. The vulnerability is rated high severity by Red Hat due to the potential for privilege escalation or identity assumption.

Red Hat currently does not provide an official fix or effective mitigation that meets their criteria for ease of use, deployment, and applicability. Users should monitor Red Hat advisories for updates. Where possible, disabling the rewrite valve or avoiding its use may reduce exposure. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. No temporary fixes or patches are currently available from Red Hat.