PT-2026-114872 · Git+1 · Jetty.Project+1
CVE-2026-19864
·
Published
2026-10-15
·
Updated
2026-10-15
CVSS v4.0
5.6
Medium
| Vector | AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Eclipse Jetty (affected versions not specified)
Description
The
SessionAuthentication component retains authentication credentials within a serializable object. If these credentials include a plaintext password and the authenticated session is saved to a session data store, the password may be written to persistent storage in plaintext. An attacker with sufficient privileges to access the persisted session data could retrieve the plaintext passwords of authenticated users.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jetty.Project
Org.Eclipse.Jetty:Jetty-Security