Detect Apache Tomcat DIGEST Authenticator Capture-Replay Authentication Bypass (CVE-2026-65905) in Sumo Logic CSE
Detects exploitation attempts and vulnerable configurations related to CVE-2026-65905, an authentication bypass by capture-replay in Apache Tomcat's DIGEST authenticator. Due to improper nonce/nonce-count validation (CWE-294), a network attacker who can capture a valid HTTP DIGEST Authorization header can replay it to authenticate as the victim, bypassing authentication (CVSS 9.8). Detection focuses on repeated DIGEST Authorization headers reusing identical nonce/cnonce/response values, anomalous nonce-count (nc) reuse or non-monotonic nc sequences, and successful authenticated access following replayed credentials against Tomcat instances. Affected: Tomcat 11.0.0-M1<11.0.25, 10.1.0-M1<10.1.58, 9.0.0.M1<9.0.121, 8.5.0<=8.5.100, 7.0.30<=7.0.109.
MITRE ATT&CK
- Tactic
- Initial Access Credential Access
Sumo Detection Query
_sourceCategory=web/tomcat OR _sourceCategory=web/apache OR _sourceCategory=web/iis
| parse regex "[Dd]igest\s+.*?nonce=\"?(?<nonce>[^\",]+)\"?" nodrop
| parse regex "response=\"?(?<dresponse>[0-9a-fA-F]+)\"?" nodrop
| parse regex "nc=(?<nc>[0-9a-fA-F]+)" nodrop
| where !isBlank(dresponse)
| count as replay_count, count_distinct(src_ip) as distinct_src, values(src_ip) as src_ips by nonce, dresponse
| where replay_count > 1 and distinct_src > 1
| sort by replay_countSurfaces DIGEST nonce+response pairs reused from multiple client IPs against Tomcat/Apache/IIS logs in Sumo Logic.
Data Sources
Required Tables
False Positives & Tuning
- Distributed monitoring replaying cached auth
- Load-balancer source-IP collapsing
- Short nonce lifetimes causing benign reuse within a valid window
Other platforms for CVE-2026-65905
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Replay captured DIGEST Authorization header
Expected signal: Web access log records an identical DIGEST Authorization header (same nonce and response) from a new source IP.
- Test 2Reuse identical nonce-count across requests
Expected signal: Two access-log entries with identical nonce and nc=00000001 for the same URI.
- Test 3Confirm DIGEST authenticator enabled on vulnerable Tomcat
Expected signal: Server responds with 401 and a 'WWW-Authenticate: Digest' header disclosing realm and nonce.
Response Playbook
Triage
- Confirm the target host runs an affected Apache Tomcat version (11.0.0-M1<11.0.25, 10.1.0-M1<10.1.58, 9.0.0.M1<9.0.121, 8.5.0<=8.5.100, 7.0.30<=7.0.109) and that a DIGEST authenticator is configured in server.xml/web.xml (auth-method DIGEST).
- Extract the reused nonce and response values from the alert and count how many distinct source IPs and User-Agents presented the identical credential; genuine capture-replay shows the same response hash from unrelated clients.
- Correlate the replayed request timestamps with the original legitimate authentication to identify whether an attacker window overlaps a captured session, and review what resources were accessed after the replay.
- Determine whether the connection was over plaintext HTTP (enabling passive capture) versus TLS, since capture-replay is most feasible on unencrypted or MITM-exposed channels.
Containment
- Disable the DIGEST authenticator and switch the affected web application to FORM or CLIENT-CERT authentication over TLS, or place the app behind an authenticating reverse proxy until patched.
- Block the offending source IPs at the WAF/firewall and invalidate active sessions; force credential reset for any account whose DIGEST response was replayed.
- Enforce HTTPS-only (redirect HTTP->HTTPS, enable HSTS) to eliminate the passive capture vector while patching proceeds.
Evidence Collection
- Preserve raw web/access logs and any packet captures showing the original and replayed Authorization headers, including full nonce, nc, cnonce and response fields.
- Capture the Tomcat version banner, server.xml, and web.xml auth configuration for the affected connector/context.
- Export the correlated alert timeline (first-seen legitimate auth vs replayed requests) and the list of resources accessed under the replayed identity.
Escalation Criteria
- !Escalate to incident response if a replayed DIGEST credential resulted in successful access to sensitive endpoints or data exfiltration.
- !Escalate to vulnerability management for emergency patching if any internet-facing Tomcat instance is confirmed on an affected version with DIGEST auth enabled.
- !Escalate if the same replayed credential is observed against multiple hosts, indicating lateral or campaign activity.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Tomcat/Apache/IIS access logs containing repeated identical DIGEST Authorization headers - >
server.xml and web.xml showing DIGEST auth-method configuration and Tomcat version - >
Packet captures or proxy logs evidencing the captured-then-replayed nonce/response pair
Tuning Guidance
Baseline legitimate shared-credential and monitoring traffic first, then whitelist known health-check source IPs and service accounts. Raise the distinct-source threshold in NAT-heavy environments and lower the correlation window if the server uses short nonce lifetimes. Focus on plaintext-HTTP paths and DIGEST-configured contexts to reduce noise, and prioritize alerts where the replayed request accessed protected resources.
Hunting Queries
Hunts for identical DIGEST nonces reused across requests with repeated or non-monotonic nonce-count (nc) values, which indicates replay rather than a fresh client challenge.
W3CIISLog | extend AuthHeader = tostring(column_ifexists("csAuthorization","")) | where AuthHeader has "Digest" | extend Nonce=extract(@'nonce="?([^",]+)"?',1,AuthHeader), NC=extract(@'nc=([0-9a-fA-F]+)',1,AuthHeader) | summarize NCs=make_set(NC,50), Reqs=count() by Nonce, cIP | where Reqs>1index=web (sourcetype=iis OR sourcetype=tomcat:access) | rex field=_raw "nonce=\"?(?<nonce>[^\",]+)\"?" | rex field=_raw "nc=(?<nc>[0-9a-fA-F]+)" | stats values(nc) as ncs count by nonce src_ip | where count>1Atomic Red Team Tests
In a lab, capture a valid DIGEST Authorization header from a legitimate authenticated request and replay it verbatim from a second host to confirm the server accepts the reused nonce+response.
Command
AUTH='Digest username="user", realm="tomcat", nonce="abc123", uri="/protected/", response="deadbeefdeadbeefdeadbeefdeadbeef", nc=00000001, cnonce="xyz", qop=auth'; curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: $AUTH" http://tomcat-lab:8080/protected/Cleanup
unset AUTHExpected Telemetry
Web access log records an identical DIGEST Authorization header (same nonce and response) from a new source IP.
Expected Detection
Detection fires on identical nonce+response reuse across multiple source IPs.
Send two requests with the same DIGEST nonce and the same nc value, which a compliant authenticator must reject but a vulnerable one accepts.
Command
for i in 1 2; do curl -s -o /dev/null -w "%{http_code}\n" -H 'Authorization: Digest username="user", realm="tomcat", nonce="fixednonce", uri="/protected/", response="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", nc=00000001, cnonce="c1", qop=auth' http://tomcat-lab:8080/protected/; doneCleanup
echo 'no cleanup required'Expected Telemetry
Two access-log entries with identical nonce and nc=00000001 for the same URI.
Expected Detection
Hunting query flags reused/non-monotonic nc values for a single nonce.
Enumerate whether the Tomcat instance advertises DIGEST authentication via a WWW-Authenticate challenge, indicating exposure to the capture-replay bypass.
Command
curl.exe -s -i http://tomcat-lab:8080/protected/ | findstr /I "WWW-Authenticate Digest Server"Cleanup
echo doneExpected Telemetry
Server responds with 401 and a 'WWW-Authenticate: Digest' header disclosing realm and nonce.
Expected Detection
Configuration hunt identifies DIGEST auth-method on an affected Tomcat version.