CVE-2026-19864mediumCWE-312

CVE-2026-19864: medium-severity vulnerability in Eclipse Foundation org.eclipse.jetty:jetty-secu…

Published

Follow this CVE+ Monitor org.eclipse.jetty:jetty-security+ Monitor jetty9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.6epss 0.1%
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Eclipse Foundation · org.eclipse.jetty:jetty-security
Related CVEs — Eclipse Foundation org.eclipse.jetty:jetty-secu…

In the same product, most dangerous first.

CVE-2026-18659MEDIUMUnauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substringEPSS 0.4%CVE-2026-18662MEDIUMCVE-2026-18662EPSS 0.4%