Incorrect authorization in Jetty - CVE-2026-18659
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization constraints and access protected functionality.
The vulnerability exists due to incorrect authorization caused by substring matching instead of exact method matching in ConstraintSecurityHandler.getConstraint() when evaluating HTTP method omission constraints. A remote attacker can send a request using an HTTP method whose name is a substring of an omitted method name to bypass authorization constraints and access protected functionality.
Exploitation requires the endpoint to serve the colliding request method. For example, omitting PROPPATCH can leave PATCH requests unprotected, and omitting UNLOCK can leave LOCK requests unprotected. Blanket constraints without HTTP method restrictions are not affected.