Apache Tomcat contains an improper authentication vulnerability (CVE-2026-55955) affecting multiple versions from 7.0.100 through 11.0.22. This flaw allows a replay attack against the EncryptionInterceptor in the cluster component. The issue is fixed in versions 11.0.23, 10.1.56, and 9.0.119.