CVE-2024-52316 is an unchecked error condition vulnerability in Apache Tomcat's handling of authentication when configured with a custom Jakarta Authentication ServerAuthContext component. If such a component throws an exception during authentication without explicitly setting an HTTP failure status, the authentication process may not fail as intended, resulting in an authentication bypass. Although no known Jakarta Authentication components currently exhibit this behavior, the vulnerability affects Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0 through 9.0.95, 10.1.0 through 10.1.30, and 11.0.0. The issue is fixed in versions 9.0.96, 10.1.31, and 11.0.0.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication controls if a custom Jakarta Authentication ServerAuthContext component throws an exception without setting an HTTP failure status. This could lead to unauthorized access to applications hosted on affected Apache Tomcat servers. However, no known Jakarta Authentication components currently behave in this vulnerable manner, which may limit the practical impact.

A patch is available. Users are recommended to upgrade Apache Tomcat to versions 11.0.0, 10.1.31, or 9.0.96 or later, which include fixes for this vulnerability. Applying these official updates will remediate the authentication bypass issue. No other specific mitigations are indicated by the vendor advisory.