CVE-2026-76184: CWE-200 in Eclipse Foundation Eclipse Jetty
Description
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.
CVSS v4.0
Score 8.2high
Affected software
Eclipse Foundation
Eclipse Jetty
pkg:maven/org.eclipse.jetty/jetty-httpclientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Eclipse Jetty versions 9.4.0 through 9.4.64, 10.0.0 through 10.0.32, 11.0.0 through 11.0.32, 12.0.0 through 12.0.38, and 12.1.0 through 12.1.12, the HttpClient component fails to properly normalize redirect paths containing sequences like '/../'. This causes the client to send authentication credentials intended for a secure path to a different, attacker-controlled path on the same domain. The vulnerability is classified as CWE-200 (Information Exposure) and has a CVSS 4.0 score of 8.2 (high severity).
Potential Impact
An attacker who can control redirects on the same domain can cause the HttpClient to send sensitive Authorization headers to a malicious path, potentially exposing credentials. This could lead to unauthorized access or credential leakage within the scope of the same domain. However, exploitation requires the attacker to have an application deployed on the same domain as the target.
Mitigation Recommendations
No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid accepting redirects from untrusted sources on the same domain or implement additional validation of redirect paths to ensure proper normalization before following them.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-08-19T10:40:46.320Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad097062cdf04f6561d2786
Added to database: 10/15/2026, 09:04:06 UTC
Last enriched: 10/15/2026, 09:18:22 UTC
Last updated: 10/15/2026, 19:00:27 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.