CVE-2026-5795

Name of the Vulnerable Software and Affected Versions Eclipse Jetty (affected versions not specified)

Description Eclipse Jetty's JASPIAuthenticator class sets two ThreadLocal variables during authentication checks. Under certain conditions, the code returns early without clearing these ThreadLocal variables. A subsequent request using the same thread inherits these values, resulting in broken access control and potential privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.