CVE-2026-76184: Infoleak
In Eclipse Jetty, HttpClient may receive a redirect of the form:
/secure/../evil
If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the Authorization header for /secure to /evil.
This also mean that the attacker must have an evil application deployed on the same domain as the target.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to control redirects processed by Jetty HttpClient and must have an evil application deployed on the same domain as the target application. The redirect must use a path such as /secure/../evil that causes credential matching to occur before path normalization.
What information could be exposed?
The HttpClient can send the Authorization header intended for the /secure path to the normalized /evil path. This can expose authentication credentials to the attacker-controlled application on that domain.
Are applications on other domains exposed through this issue?
The described attack requires the evil application to be deployed on the same domain as the target. The available information does not describe cross-domain credential disclosure.