CVE-2025-49125 is a security constraint bypass vulnerability in Apache Tomcat affecting versions 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.105, 10.1.0-M1 through 10.1.41, and 11.0.0-M1 through 11.0.7. The flaw allows access to PreResources or PostResources mounted at non-root locations via unexpected paths that may not be protected by the intended security constraints, enabling authentication bypass. Fixed versions are 8.5.101+, 9.0.106+, 10.1.42+, and 11.0.8+. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity).