CVE-2026-19864

State: Published
Severity: 5.6 Medium
Published: Oct 15, 2026
Updated: Oct 15, 2026
Reserved: Aug 14, 2026

Description

Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.

An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

Scores

CVSS	Score	Vector	Source
4.0	5.6 Medium	CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	eclipse

Weaknesses

CWE-312

Affected Products

Product	Versions
org.eclipse.jetty:jetty-securityEclipse Foundation	9.4.0 through 9.4.64Affected 10.0.0 through 10.0.32Affected 11.0.0 through 11.0.32Affected 12.0.0 through 12.0.38Affected 12.1.0 through 12.1.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.