Information disclosure in Jetty - CVE-2026-76184
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive authentication credentials outside their configured path scope.
The vulnerability exists due to missing path normalization before credential scope validation in Jetty HttpClient's AbstractAuthentication.matchesURI() method when matching cached credentials to redirected request paths. A remote attacker can influence a same-origin redirect containing dot segments to disclose sensitive authentication credentials outside their configured path scope.
The demonstrated exposure involves Basic authentication; other authentication mechanisms have not been validated. The issue is particularly relevant when sibling paths belong to different applications or trust domains.