CVE-2026-19864
Eclipse Jetty's retains authentication credentials in a serializable object.
Published Oct 15, 2026 · updated Oct 15, 2026 · Eclipse Foundation
Eclipse Jetty's retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
Eclipse Jetty's retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated us
Oct 15, 2026 · NIST NVD
Updated
Eclipse Jetty's retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated us
Affected
- vendor Eclipse Foundationversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-19864
Eclipse Jetty's retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attac
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-19864
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-19864
30-day exploitation probability 0.1%
first.org - NIST NVDVulnerability recordCVE-2026-19864
Eclipse Jetty's retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storag
nvd.nist.gov