CVE-2026-19864

Overview

Eclipse Jetty is a widely used, embeddable Java web server and servlet container. It supports HTTP/1.1, HTTP/2, HTTP/3, and WebSocket, and is commonly deployed both as a standalone server and embedded within Java application runtimes and frameworks. Its jetty-security module provides the authentication and authorization framework, including the authenticators that remember a logged-in user in the HTTP session.

An information exposure vulnerability (CVE-2026-19864) has been identified in the SessionAuthentication class of Eclipse Jetty's jetty-security module, which allows attackers with read access to persisted session data to obtain the plaintext passwords of authenticated users. When a session persistence backend is configured, the cleartext password a user submitted at login is written to the session store each time the session is saved.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Eclipse Jetty.

Details

Module Info

• Product: Eclipse Jetty
• Affected packages: org.eclipse.jetty:jetty-security
• Affected versions: >=9.4.0 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32, >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.12
• GitHub repository: https://github.com/jetty/jetty.project
• Published packages: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-security
• Package manager: Maven
• Fixed in:
  • OSS Eclipse Jetty 12.0.39, 12.1.13
  • NES for Jetty v9.4.65, v10.0.33, v11.0.33

Vulnerability Info

This Medium-severity vulnerability is found in the org.eclipse.jetty:jetty-security package in multiple versions of Eclipse Jetty. After a successful login, authenticators such as FormAuthenticator cache the authenticated user in the HTTP session by storing a SessionAuthentication object, passing it the credentials the user supplied. For form login those credentials are the raw j_password form field value:

HttpSession session = ((HttpServletRequest)request).getSession(true);
Authentication cached = new SessionAuthentication(getAuthMethod(), user, password);
session.setAttribute(SessionAuthentication.__J_AUTHENTICATED, cached);

SessionAuthentication implements Serializable and keeps those credentials in a field that is not marked transient, and it does not define a custom writeObject:

public class SessionAuthentication extends AbstractUserAuthentication
    implements Serializable, HttpSessionActivationListener, HttpSessionBindingListener
{
    private final String _name;
    private final Object _credentials;
    private transient HttpSession _session;

Default Java serialization writes every non-transient field, so whenever a session is passivated or saved through a session data store (for example a file, JDBC, or distributed cache backend), the user's cleartext password is written into the persisted session data alongside the user name. The matching readObject relies on this: on deserialization it passes _name and _credentials to loginService.login to log the user in again from the stored password. Anyone who can read the session store, such as through a database compromise, access to backups or replicas, or a file read flaw, can recover the plaintext passwords of every user with a persisted authenticated session.

Mitigation

Only recent versions of Eclipse Jetty are community-supported. Only community-supported versions will receive updates to address this issue. As of January 1, 2026 the Jetty project and Webtide no longer publish Jetty 9, Jetty 10, or Jetty 11 releases to Maven Central; see the project's End-of-Life announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Eclipse Jetty (12.0.39, 12.1.13).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.