---
title: "CVE-2026-68525"
source: https://dev.pageseeder.com/guide/security/advisories/cve-2026-68525.html
description: "CVE-2026-68525 is a critical Apache Tomcat vulnerability affecting versions 9.0.0.M1 through 9.0.120 that allows bypassing method-specific security constraints via FORM authentication redirects. PageSeeder is not affected due to lack of required configuration."
last_updated: 2026-11-13T09:41:36+11:00
tokens: ~1097
---

# CVE-2026-68525


        *Apache Tomcat: FORM authentication redirect bypass of method constraints*
      

| Property | Value |
| --- | --- |
| Published | 2026-08-25 |
| Last updated | 2026-11-11 |
| Component | Apache Tomcat |
| Severity | Critical |
| PageSeeder status | Not affected |

## Summary

Tomcat’s FORM authentication redirect processing can bypass a method-specific security constraint, such as a restriction on POST that does not also apply to GET.

The issue affects Apache Tomcat 9.0.0.M1 through 9.0.120 in the 9.0 branch and is fixed in Tomcat 9.0.121. The bundled version, 9.0.120, falls within this version range; exploitability depends on the conditions described below.

The Critical classification reflects the CISA assessment in the CVE record: 9.1 (CVSS 3.1). Apache rates this issue Low. The upstream severity is distinct from PageSeeder exposure.

For technical details, see the [Apache Tomcat security advisory](https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7).

## PageSeeder impact assessment

| Property | Value |
| --- | --- |
| Affected dependency | Apache Tomcat 9.0.120 (bundled) |
| PageSeeder versions assessed | Reviewed repository: 6.3003, bundling Tomcat 9.0.120; historical releases not independently assessed |
| Vulnerability status | Not affected |
| Conditions required for exploitation |  |
| Relevant PageSeeder configuration |  |
| Assessment date | 2026-11-11 |

### Assessment

PageSeeder is not affected by CVE-2026-68525 in the reviewed standard configuration because the required configuration or application usage was not found.

Required conditions for exploitation: Tomcat FORM authentication combined with method-specific security constraints, including a resource whose POST access is restricted differently from GET access.

Relevant PageSeeder configuration: No Tomcat FORM login-config or matching method-specific declarative security constraints were found in the supplied PageSeeder applications.

Evidence from source and configuration review:

- The reviewed web.xml files do not configure Tomcat FORM authentication.
- No matching method-specific declarative security constraints were found.
- PageSeeder application login processing does not by itself enable Tomcat FORM authentication.

This assessment is limited to the repository revision and configuration reviewed on 11 November 2026. It does not independently verify the historical PageSeeder version range in the model advisory. Customised connectors, deployment descriptors, extensions and additional web applications may change exposure.

The PageSeeder installer source was also reviewed at commit a08323b (Windows, Linux EL7, EL8 and EL9). Installer review supports the standard configuration assessment; it does not establish the configuration of every deployed server. Linux RPM packaging marks server.xml CONFIG | NOREPLACE, so existing administrator changes can survive upgrades.

## Recommended action

Administrators who configure Tomcat FORM authentication with method-specific constraints should upgrade to Tomcat 9.0.121 or later, preferably 9.0.123 or later. Review constraints in all additional hosted applications.

For installations matching the reviewed unaffected configuration, no CVE-specific emergency change is required. Confirm the installed configuration before relying on this conclusion. Use a supported PageSeeder distribution containing an updated Tomcat where available; this advisory does not announce a PageSeeder release date or confirm that such a distribution has shipped.

Dependency maintenance recommendation: update the bundled Tomcat to 9.0.123 or a later supported release, which also incorporates fixes for the other Critical CVEs covered in this advisory set.

> **Warning:** This assessment is based on source code and configuration review. It has not been verified through deployed server inspection or active exploit testing.

## References

- 
          [CVE-2026-68525 record and CISA severity assessment](https://www.cve.org/CVERecord?id=CVE-2026-68525)
        
- 
          [Apache Tomcat security advisory](https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7)
        
- 
          [Apache Tomcat 9 security advisories](https://tomcat.apache.org/security-9)
        
- 
          [Apache Tomcat 9 changelog](https://tomcat.apache.org/tomcat-9.0-doc/changelog.html)