What is GHSA-7895-gffq-w6jq?

GHSA-7895-gffq-w6jq is a security advisory published by GitHub Security Advisories with High severity. Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was...

Which CVE IDs does GHSA-7895-gffq-w6jq cover?

GHSA-7895-gffq-w6jq covers the following CVE IDs: CVE-2026-55957. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7895-gffq-w6jq?

GHSA-7895-gffq-w6jq has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

GHSA-7895-gffq-w6jqHighCVSS 7.3

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was...

Vendor

GitHub Security Advisories

Published

June 29, 2026

Last Modified

June 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-55957 →

📋 Description

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-55957
https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh
http://www.openwall.com/lists/oss-security/2026/06/29/26
https://github.com/advisories/GHSA-7895-gffq-w6jq