CVE-2026-19863
Awaiting Analysis Awaiting Analysis - Queue

EthereumAuthenticator Path Traversal via Unanchored Login Path Match

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-19863
EUVD
EUVD-2026-101993

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
org.eclipse.jetty jetty-ethereum From 12.1.0 (inc) to 12.1.12 (inc)
org.eclipse.jetty jetty-security From 12.1.0 (inc) to 12.1.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19863 is an authentication bypass vulnerability in Jetty's EthereumAuthenticator. It occurs because the authenticator uses an unanchored substring match to identify the login page. If a protected resource path contains the configured login path as a later segment, the request may be treated as the login page, bypassing authentication and role constraints. For example, a request to /protected/login/secret would bypass authentication if /login is the configured login path.

Detection Guidance

Check if your system uses Jetty versions 12.1.0 to 12.1.12 with EthereumAuthenticator enabled. Inspect server logs for requests to protected paths containing the login path as a substring. Test by sending requests to paths like /protected/login/secret and verify if authentication is bypassed.

Impact Analysis

This vulnerability allows unauthenticated attackers to access protected resources by including the login path as a substring in the request path. It can lead to unauthorized access to sensitive data or functions, potentially compromising confidentiality and integrity. Exploitation requires a protected route containing the login path as a later segment, such as /protected/login/secret.

Compliance Impact

This vulnerability could lead to unauthorized access to protected resources, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by allowing unauthorized access to personal or health-related data.

Mitigation Strategies

Upgrade to Jetty version 12.1.13 or later to patch the vulnerability. If upgrading is not immediately possible, disable EthereumAuthenticator or reconfigure login paths to avoid substring matches in protected routes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart