Session Authentication Vulnerability in Eclipse Jetty Web Server
CVE-2026-19864

5.6MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Vendor
CVE Published:
15 October 2026

What is CVE-2026-19864?

Eclipse Jetty's SessionAuthentication component improperly manages authentication credentials by retaining them in a serializable object. This misconfiguration allows plaintext passwords to be stored when an authenticated session is persisted to a session data store. If an attacker has sufficient privileges to access this stored session data, they may retrieve sensitive plaintext passwords of authenticated users, posing a significant security risk.

References

https://github.com/jetty/jetty.project/security/advisorie...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
5.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.