Authentication Bypass Vulnerability in Jetty HttpClient
CVE-2026-77711

8.2HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
15 October 2026

What is CVE-2026-77711?

A vulnerability exists in Jetty's HttpClient where a request sent through a forward proxy can lead the client to incorrectly handle a 407 Proxy Authentication Required response. Instead of recognizing that the response originates from the server, the client misinterprets it as being sent by the proxy. Consequently, it resends the request including the Proxy-Authorization header, inadvertently exposing proxy authentication credentials to the original server. This potentially allows unauthorized access and compromise of sensitive credentials.

Affected Version(s)

Eclipse Jetty 12.1.0 <= 12.1.12

Eclipse Jetty 12.0.0 <= 12.0.38

Eclipse Jetty 11.0.0 <= 11.0.32

References

https://github.com/jetty/jetty.project/security/advisorie...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/4ra1n
https://github.com/pyn3rd
https://github.com/unam4
.