Weakness (CWE)

CWE-304: Missing Critical Step in Authentication

Base Draft

The product implements an authentication technique, but it skips a step that weakens the technique.

Source: MITRE CWE-304

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.3

CVE-2026-55957 Public exploit

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven

Jun 29, 2026