CVE-2026-76184
In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials ag…
Published Oct 15, 2026 · updated Oct 15, 2026 · Eclipse Foundation Eclipse Jetty
In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials against rather than normalizing the path to , and will therefore follow the redirect sending the header for to . This also mean that the attacker must have an evil application deployed on the same domain as the target.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials against rather than normalizing the path to , and will therefore follow the redirect sending the header for to . This also mean that the attacker must have an evil application deployed on the same domain as the target.
Oct 15, 2026 · NIST NVD
Updated
In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials against rather than normalizing the path to , and will therefore follow the redirect sending the header for to . This also mean that the attacker must have an evil application deployed on the same domain as the target.
Affected
- vendor Eclipse Foundation Eclipse Jettyversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-76184
In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials against rather than normalizing the path to , and will therefore follow the redirect sending the header for to . Th
cve.org - FIRST EPSSExploitation probabilityCVE-2026-76184
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-76184
In Eclipse Jetty, HttpClient may receive a redirect of the form: If an attacker is able to control the redirects, then HttpClient matches authentication credentials against rather than normalizing the path to , and will therefo
nvd.nist.gov