CVE-2026-19864: Eclipse Jetty vulnerability
Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.
An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to credential disclosure?
Deployments that persist authenticated Jetty sessions to a session data store are exposed when SessionAuthentication credentials include a plaintext password. An attacker must have sufficient privileges to read the persisted session data.
What must be true for an attacker to obtain passwords?
The affected authenticated session must be persisted, and its credentials must contain a plaintext password. The attacker must then be able to access the persistent session storage.
How can I determine whether stored sessions may contain passwords?
Review whether authenticated Jetty sessions are persisted to a session data store and inspect the stored session data for serialized SessionAuthentication objects containing credential values. Password exposure is possible only when those credentials contain plaintext passwords.