CVE-2023-41080
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
The 'Open Redirect' vulnerability in the FORM authentication feature of Apache Tomcat allows redirecting users to untrusted sites. This affects Apache Tomcat versions from 11.0.0-M1 to 11.0.0-M10, from 10.1.0-M1 to 10.0.12, from 9.0.0-M1 to 9.0.79, and from 8.5.0 to 8.5.92.
Risk Assessment
An attacker could exploit this vulnerability to trick users into visiting malicious sites, potentially leading to data theft or malware.
Recommendation
It is recommended to update Apache Tomcat to the latest version to mitigate this vulnerability and to monitor the application for potential exploitation attempts.
Other vulnerabilities in Apache Tomcat
See all- CVE-2026-93446Unknown
Incomplete cleanup in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. The issue affects versions 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122.
- CVE-2026-88041Unknown
Incomplete cleanup in Apache Tomcat allowed trailer information from a previous request to leak into a subsequent request. The issue affects versions 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122.
- CVE-2026-80353Unknown
A TOCTOU race condition in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. The issue affects versions 9.0.47 through 9.0.122.
- CVE-2026-74049Unknown
Execution After Redirect (EAR) vulnerability in Apache Tomcat. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.
- CVE-2026-74048Unknown
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat: if OpenSSLLifecycleListener is configured for FIPS mode but FIPS activation fails, Tomcat logs an error but continues using JSSE in non-FIPS mode with the provided configuration. Affects versions 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.
- CVE-2026-43513High
The vulnerability related to improper handling of case sensitivity in LockOutRealm in Apache Tomcat may lead to unauthorized access. It affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 8.5.0 to 8.5.100, and from 7.0.0 to 7.0.109.
- CVE-2026-42498High
A vulnerability in Apache Tomcat related to the exposure of the HTTP Authentication Header to unexpected hosts during WebSocket authentication. It affects versions from 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.2 to 9.0.117, 8.5.24 to 8.5.100, and 7.0.83 to 7.0.109.
- CVE-2026-41284High
There is a vulnerability in Apache Tomcat related to resource allocation without limits or throttling. This affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, and from 9.0.0.M1 to 9.0.117.
- CVE-2025-48989High
A vulnerability in Apache Tomcat related to improper resource shutdown or release allows for a 'made you reset' attack. This affects versions from 11.0.0-M1 to 11.0.9, from 10.1.0-M1 to 10.1.43, and from 9.0.0.M1 to 9.0.107.
- CVE-2017-7675High
The HTTP/2 implementation in Apache Tomcat from version 9.0.0.M1 to 9.0.0.M21 and from 8.5.0 to 8.5.15 bypassed several security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS