IE NTLM vulnerability?

I wrote a filter code on Tomcat to read the NTLM credentials from IE
and do a Base 64 decode and get the user-id. I noticed that when I
change IE NTLM settings to manually enter user-id and password, IE
lets me through with any user-id and does not validate the login I
enter against any source.

Is this a security hole?

It could be using cached credentials and automatically logging in.

It could be using cached credentials and automatically logging in. You
already authenticated yourself when you logged in to Windows, so this might
be okay.

I would check your "User Authentication" settings for the zone.

Paul