Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-19863: EthereumAuthenticator may let unauthenticated users reach protected pages
CVE-2026-19863 · published today
Summary
When the login URL is included later in a request path, the EthereumAuthenticator mistakenly treats the request as a login and allows access without checking credentials. This can expose internal resources to anyone who knows the pattern. Update the authenticator to use exact URL matching or change the login path to avoid overlapping with protected URLs.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | – | <= 12.1.12 |
Original advisory text
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
This is caused by the authenticator usin...
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.
Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.
Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-6m7j-pjmp-crgq Vendor Advisory
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/230 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19863... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-19863 Vendor Advisory
- https://repo.maven.apache.org/maven2/ URL
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.1
Critical
Type
CWE-288Authentication Bypass Using Alternate Path
CWE-863Incorrect Authorization
Timeline
Published15 Oct 2026
Updated16 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta