CVE-2026-19864

A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can exploit this flaw to obtain the plaintext passwords of authenticated users.

A flaw was found in org.eclipse.jetty/jetty-security. Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.

An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users. Prerequisites: Valid credentials or authentication bypass CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). None -- NVD score appropriate Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM. This issue affects amq-7, exploit-intelligence, fedora-all, fuse-7, ocp-tools-4, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-hawtio-4, rhel-7, rhel-9, rhel-br-10, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat recommends updating org.eclipse.jetty/jetty-security to the latest version when a fix is available.