Search: CVE-2026-68525

CVE-2026-68525 is a critical incorrect authorization vulnerability in Apache Tomcat's FORM authentication process. It allows bypassing a security constraint that restricts user access to a resource's POST method but not the GET method. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24, including some end-of-life versions. The issue is fixed in versions 11.0.25, 10.1.58, and 9.0.121.