Unauthenticated Resource Access in EthereumAuthenticator by Jetty

CVE-2026-19863

What is CVE-2026-19863?

The EthereumAuthenticator component by Jetty is susceptible to an authentication bypass vulnerability. This issue arises when an unauthenticated client can gain access to protected resources if the request path mistakenly includes the login path as a substring. The authenticator improperly recognizes the request as a legitimate login attempt if the login path is found later in the request URL. This flaw allows attackers to circumvent authentication measures, granting unauthorized access to sensitive resources while leaving explicitly blocked routes unaffected.

References