Eclipse Jetty HttpClient: Credential leak via non-normalized redirect path
Summary
Eclipse Jetty HttpClient matches cached Basic authentication credentials against the raw redirect path before dot segments are removed. A crafted same-origin redirect such as /private/../privateevil/collect therefore sends the credential to a sibling path outside its configured scope. An attacker who can influence redirects and host an application on the same domain as the target can obtain the username and password.
Affected
- org.eclipse.jetty:jetty-client 12.1.0 to 12.1.12
- org.eclipse.jetty:jetty-client 12.0.0 to 12.0.38
- org.eclipse.jetty:jetty-client 11.0.0 to 11.0.32
- org.eclipse.jetty:jetty-client 10.0.0 to 10.0.32
- org.eclipse.jetty:jetty-client 9.4.0 to 9.4.64
Fixed in
- 12.1.13
- 12.0.39
- 11.0.33
- 10.0.33
- 9.4.65
- Third-party sources state that Jetty 9, 10 and 11 are no longer published to Maven Central. Confirm the availability of these fixes before relying on them.
Workaround
- No official workaround known.
- Limit automatic redirect following in HttpClient where Basic credentials are used.
- Do not host untrusted applications on the same host as services that receive Basic credentials.
Exploitation
- The GHSA advisory includes a complete proof of concept for Basic authentication.
- CISA SSVC: exploitation PoC, not automatable, partial technical impact.
- No known exploitation in the wild found at the time of research.
Our recommendation
- Identify all Jetty artifacts in Java applications and appliances using an SBOM or dependency scan.
- Check whether applications use HttpClient with stored Basic credentials and which hosts they contact.
- Upgrade Jetty 12 to 12.0.39 or 12.1.13.
- For Jetty 9, 10 or 11, ask the vendor for a supported fixed release or migration plan and document the risk until then.
- Monitor the NVD record for final analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qfr2-43g5-g768 github.com
- Eclipse CVE assignment ticket #236 gitlab.eclipse.org
- HeroDevs vulnerability directory: CVE-2026-76184 www.herodevs.com
- VulDB: CVE-2026-76184 vuldb.com
- NVD record via Vulners: CVE-2026-76184 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:01.
Original description (NVD)
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.