6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55668

CVE-2025-55668: Apache Tomcat Session Fixation vulnerability

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55668

CVE-2025-55668:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.tomcat:tomcat-catalina	maven	>= 11.0.0-M1, < 11.0.8	11.0.8
org.apache.tomcat:tomcat-catalina	maven	>= 10.1.0-M1, < 10.1.42	10.1.42
org.apache.tomcat:tomcat-catalina	maven	>= 9.0.0.M1, < 9.0.106	9.0.106

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commits clearly indicates that the session fixation vulnerability is located in the invoke method of the org.apache.catalina.valves.rewrite.RewriteValve class. The patches for CVE-2025-55668 across multiple Tomcat versions all point to the same change: replacing a direct call to response.sendRedirect() with response.sendRedirect(response.encodeRedirectURL(redirectPath)). This change is critical for preventing session fixation attacks when URL rewriting is used for session tracking.

The encodeRedirectURL method ensures that the session ID is properly appended to the redirect URL, maintaining session integrity. The vulnerable version of the invoke method failed to do this, allowing an attacker to inject a known session ID into a victim's browser. When the victim authenticates, the attacker can then use that same session ID to hijack the authenticated session.

The other change in the patch, making Request.recycleSessionInfo() public and calling it from the RewriteValve, is a secondary part of the fix to ensure that session information is properly cleared when handling cross-context requests within the rewrite valve, further hardening the session management logic. However, the primary vulnerable function is RewriteValve.invoke because it is the function that directly handles the vulnerable redirect logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.