Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.2 to 9.0.117 Older, unsupported versions may also be affected
Description: If a WebSocket request was redirected after authentication, Tomcat's WebSocket client would present the most recent authentication header to the redirect target host.
Mitigation: Users of the affected versions should apply one of the following mitigations:
Credit: This issue was identified by lokerxx
{
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-18T20:29:53Z",
"nvd_published_at": "2026-05-12T16:16:17Z",
"severity": "HIGH"
}