CVE-2026-19863
9.3CriticalPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-288, CWE-863
Impact
Unauthenticated attackers can bypass authentication and access protected resources over the network. They only need to append the configured login path to the request URL for the target resource.
Root cause
The EthereumAuthenticator uses an unanchored substring match to detect login page requests, inadvertently downgrading authorization to ALLOWED if the login path appears anywhere in the request URL.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Eclipse Jetty to the patched release specified in the advisory, or change application routing so protected endpoint paths do not contain the configured login path substring.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.