CVEvulnerability

CVE-2026-5795

7.4 HIGH Published 2026-04-08 Modified 2026-09-14 Official page ↗
Status
Modified
Published
2026-04-08
Last modified
2026-09-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-226, CWE-287

Description

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Affected configurations

• eclipse jetty (>= 9.4.0 <= 9.4.58) • eclipse jetty (>= 10.0.0 <= 10.0.26) • eclipse jetty (>= 11.0.0 <= 11.0.26) • eclipse jetty (>= 12.0.0 < 12.0.34) • eclipse jetty (>= 12.1.0 < 12.1.8)

Related

Weakness · CWE (2)

  • CWE-226 Sensitive Information in Resource Not Removed Before Reuse weakness
  • CWE-287 Improper Authentication weakness

References