Jetty EthereumAuthenticator: Authentication bypass through unanchored login path
Summary
EthereumAuthenticator in Eclipse Jetty identifies the login page with an unanchored substring search on the request path. If a protected route contains the configured login path as a later segment, the authentication or role requirement is replaced with ALLOWED. An unauthenticated attacker can then reach protected resources without logging in. Routes explicitly set to FORBIDDEN are not affected.
Affected
- org.eclipse.jetty:jetty-ethereum 12.1.0 to 12.1.12 (per the GitHub advisory and CVE record)
- The GitHub advisory also lists org.eclipse.jetty:jetty-security 12.1.0 to 12.1.12
- Other Jetty branches: Unknown.
Fixed in
- Upgrade to 12.1.13 or later.
Workaround
- No vendor workaround published.
- If the authenticator is not needed, disable EthereumAuthenticator.
- Reject or restrict request paths that contain the login path as a later segment at a reverse proxy or WAF (own suggestion, not vendor guidance).
Exploitation
- CISA SSVC lists exploitation as poc and automatable as yes.
- The advisory includes a proof of concept.
- No evidence of in-the-wild exploitation found; no CISA KEV entry in the sources reviewed.
- EPSS reported at 0.0054 by a secondary source.
Our recommendation
- Inventory Java applications and vendor products that embed Jetty and check the Jetty version and whether EthereumAuthenticator is used.
- Upgrade to 12.1.13 or later, or to the fixed version of the vendor product.
- If an internet-facing instance cannot be patched quickly, apply the path restrictions above and review access logs for requests containing the login path in protected routes.
- Monitor the GHSA advisory and NVD for updates, including a CVSS revision (NVD and VulDB scores differ).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6m7j-pjmp-crgq github.com
- Eclipse CVE assignment ticket #230 gitlab.eclipse.org
- NVD mirror via Vulners vulners.com
- VulDB entry vuldb.com
- OpenCVE entry with SSVC data app.opencve.io
- Strix CVE overview www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:43.
Original description (NVD)
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.