Digest Authentication Vulnerability in Eclipse Jetty Affects Password Encoding Issues

CVE-2026-10050

What is CVE-2026-10050?

Eclipse Jetty contains a vulnerability within its Digest authentication mechanism where passwords are encoded using ISO-8859-1. This legacy approach leads to incorrect handling of characters outside this charset, such as Chinese, Cyrillic, or Greek characters. For instance, a password like αβ123 would incorrectly be encoded to ??123, allowing attackers to exploit this by sending requests with a digest Authorization header filled with ? characters. This could enable them to falsely authenticate using any password of the corresponding length that has non-ISO-8859-1 characters. The recent RFC-7616 includes support for charset parameters defaulting to UTF-8, providing a more secure way to encode passwords correctly.

References