## https://sploitus.com/exploit?id=E23E3D97-D430-5171-AE9A-91C7ADDA0832
# CVE-2026-55957 isolated reproduction lab
This repository reproduces the Apache Tomcat `JNDIRealm` GSSAPI authentication
bypass using only synthetic identities on an internal Docker network. No host
Kerberos configuration or keytab is read.
## Validated result
| Runtime | Correct password | Wrong non-empty password |
|---|---:|---:|
| Apache Tomcat 10.1.36 | 200 | **200 (bypass)** |
| Apache Tomcat 10.1.39 | 200 | 401 |
The wrong-password success on 10.1.36 reaches protected content and creates
the `testuser` principal, `protected` role, session, and cookie. The same
request is rejected by 10.1.39. A nonexistent username is rejected.
**CVSS 3.1:** 7.3 High —
`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L` (CISA ADP enrichment; NVD had
not published an independent score when this bundle was finalized).
## Components
- Apache Tomcat 10.1.36 (`972a4062…d743c7`, SHA-512), vulnerable.
- Apache Tomcat 10.1.39 (`55998c7e…c100e1`, SHA-512), fixed runtime control.
- MIT Kerberos KDC with generated synthetic service keytabs.
- 389 Directory Server 3.1 on internal port 3389 with Cyrus SASL/GSSAPI.
- A one-request Python probe restricted to the declared lab targets.
The source fix is commit
`0cd21c0393b8811af22daddbba7b4e7328e2d79e`. Apache's CNA data uses 10.1.37
as the semantic fixed threshold; the released binary tested here is 10.1.39.
## Reproduce
Requirements: Docker Engine, Docker Compose v2, Bash, Python 3, `sha512sum`.
```sh
./verify.sh | tee verify.log
```
The verifier checks archive hashes and runtime versions, creates fresh
Kerberos/LDAP state, and asserts the vulnerable-versus-fixed matrix. Retain
the lab for inspection with:
```sh
KEEP_LAB=1 ./verify.sh | tee verify.log
docker compose logs --no-color > compose.log
docker compose down -v
```
Host exposure is limited to `127.0.0.1:18080` and `127.0.0.1:18081`.
## Publication artifacts
- [Technical disclosure](report/apache-tomcat-jndirealm-gssapi-authentication-bypass.md)
- [Clean verification evidence](evidence/runs/2026-08-02-clean/)
- [Upstream source and patch evidence](evidence/upstream-source/)
- [Evidence manifest](evidence/SHA256SUMS)
- [Publication preflight](report/publication-preflight.md)
The dated July evidence and older short reports are historical corroboration;
they do not replace the clean publication run.
## Safety and cleanup
All credentials and principals are synthetic. LDAP is not published to the
host. Use `docker compose down -v` to delete generated keytabs and LDAP data.