Tomcat WebSocket security constraints can be bypassed
CVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
Apache Tomcat has disclosed an important authentication bypass, CVE-2026-76183, that allowed security constraints on any WebSocket endpoint to be skipped.
Mark Thomas reported the flaw as an Authentication Bypass by Alternate Name issue. It meant configured access controls for WebSocket endpoints did not reliably apply, so clients could reach those endpoints without the intended authentication or authorization checks.
The bug affects a wide range of releases still in common use: Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121. End-of-support lines including 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109 are also known to be affected; other unsupported builds may be as well.
Fixed builds are 11.0.26, 10.1.60, and 9.0.122. Operators running WebSocket applications behind Tomcat security constraints should upgrade to one of those releases.