Authentication Flaw in Jetty by Eclipse Leads to Privilege Escalation

CVE-2026-5795

What is CVE-2026-5795?

Eclipse Jetty contains an authentication flaw in the JASPIAuthenticator class. The vulnerability arises when authentication checks are performed using ThreadLocal variables that are not properly cleared upon completion of the initial checks. This oversight allows subsequent requests made on the same thread to inherit the existing ThreadLocal values, potentially leading to unauthorized access and privilege escalation within the application.

References