In Eclipse Jetty, the JASPIAuthenticator class sets two ThreadLocal variables to store authentication state during authentication checks. Under certain conditions, the authentication process returns early without clearing these ThreadLocal variables. As a result, a subsequent request processed on the same recycled thread inherits the un-cleared ThreadLocal values. This leads to broken access control, authentication bypass, privilege escalation, and potential data breaches. The vulnerability requires the reuse of the exact same thread for a subsequent request, increasing exploitation complexity. Red Hat has rated this vulnerability as important and advises updating the affected package as soon as possible. No practical mitigation other than patching is currently available.

The vulnerability allows broken access control and privilege escalation due to authentication state leakage via un-cleared ThreadLocal variables. This can lead to authentication bypass and data breaches if a subsequent request reuses the same thread. However, exploitation complexity is high because it requires thread reuse. There are no known exploits in the wild. The CVSS v3.1 base score is 7.4 (High), reflecting high confidentiality and integrity impact but no availability impact.

A fix is available and users are advised to update to a patched version of Eclipse Jetty as soon as possible. No practical mitigation other than patching has been identified by the vendor. Users should monitor vendor advisories for updates and apply security updates promptly.