Executive brief
Eclipse Jetty, a widely used web server and servlet engine, contains a security flaw in its JASPI authentication component. Under specific conditions, the server fails to clear security credentials from its internal memory after a request is processed. This allows a new, unauthenticated user to potentially inherit the permissions and identity of a previous user, leading to unauthorized access to sensitive data or administrative functions.
Technical details
A vulnerability exists in the JASPIAuthenticator class within Eclipse Jetty due to improper management of ThreadLocal variables. When processing authentication checks, the authenticator sets metadata in ThreadLocal storage; however, certain error conditions or missing callbacks (such as a missing CallerPrincipalCallback) trigger an early return before these variables are cleared. Because Jetty reuses worker threads for subsequent requests, a new request handled by the same thread can inherit the stale security context. This results in a broken access control scenario where an unauthenticated attacker can achieve privilege escalation by reusing the security roles of a previously authenticated user.
Affected products
- Eclipse Jetty 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.33, 12.1.0 to 12.1.7
Timeline
- 2026-04-08: disclosed: Initial advisory publication
- 2026-04-11: advisory: Detailed advisory GHSA-r7p8-xq5m-436c published
- 2026-04-14: other: Duplicate advisory GHSA-gc59-r5jq-98qw withdrawn in favor of original report