CVE-2026-19864: CWE-312
Description
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
CVSS v4.0
Score 5.6medium
Affected software
Eclipse Foundation
pkg:maven/Eclipse Foundation/org.eclipse.jetty:jetty-securityRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19864 describes a vulnerability in Eclipse Jetty's SessionAuthentication where authentication credentials, including plaintext passwords, are retained in a serializable object. When the authenticated session is persisted, the plaintext password may be stored in persistent storage. This exposure allows an attacker with read access to the session data store to retrieve plaintext passwords of authenticated users. The vulnerability affects versions >=9.4.0 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32, >=12.0.0 <=12.0.38, and >=12.1.0 <=12.1.12. No patch or remediation details are provided in the input data.
Potential Impact
An attacker with sufficient privileges to read persisted session data can obtain plaintext passwords of authenticated users, potentially compromising user accounts. The vulnerability requires local or limited access (AV:L) and privileges (PR:H), with no user interaction needed. The impact is confidentiality loss of sensitive authentication credentials.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to session data stores to trusted administrators only and consider encrypting session storage to protect sensitive data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-08-14T10:15:18.422Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad0a51e2cdf04f6562437ba
Added to database: 10/15/2026, 10:04:14 UTC
Last enriched: 10/15/2026, 10:18:36 UTC
Last updated: 10/15/2026, 19:00:27 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.