CVE-2026-19864
Received Received - Intake

Eclipse Jetty SessionAuthentication Plaintext Password Exposure

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-19864
EUVD
EUVD-2026-101994

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
eclipse jetty From 9.4.0 (inc) to 9.4.64 (inc)
eclipse jetty From 10.0.0 (inc) to 10.0.32 (inc)
eclipse jetty From 11.0.0 (inc) to 11.0.32 (inc)
eclipse jetty From 12.0.0 (inc) to 12.0.38 (inc)
eclipse jetty From 12.1.0 (inc) to 12.1.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Eclipse Jetty's SessionAuthentication class stores authentication credentials in a serializable object. When sessions are persisted to storage, plaintext passwords may be written to disk or databases. Attackers with access to these stores can retrieve the passwords.

Detection Guidance

Check if your Jetty server uses session persistence with FileSessionDataStore, JDBC, Redis, or Hazelcast. Inspect session data files or databases for plaintext passwords. Review Jetty logs for session serialization events. Use commands like grep -r 'SessionAuthentication' /path/to/jetty/logs or search session stores for password fields.

Impact Analysis

If you use affected Jetty versions with session persistence enabled, your plaintext passwords could be exposed. Attackers gaining access to session data stores (databases, files, backups) may steal credentials, leading to account compromise or credential stuffing attacks.

Compliance Impact

Storing plaintext passwords violates security best practices and likely breaches GDPR (data protection), HIPAA (health data), and other regulations requiring encryption of sensitive data. Non-compliance risks fines and legal consequences.

Mitigation Strategies

Upgrade Jetty to patched versions: 9.4.65, 10.0.33, 11.0.33, 12.0.39, or 12.1.13. Avoid using FormAuthenticator, BasicAuthenticator, or other login methods that store plaintext passwords. Review session persistence configurations to ensure no plaintext passwords are stored.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19864. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart