Vulnerability in Eclipse Foundation

[ Description ]Official description

Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund15 Oct 2026WID-SEC-2026-3992

  Eclipse Jetty: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-18661CVE-2026-76184CVE-2026-19864+4 more CVEs

[ References ]References

• github.com/jetty/jetty.project/security/advisories/GHSA-q6wx-j9wr-fj7f
• gitlab.eclipse.org/security/cve-assignment/-/work_items/229