Jetty EthereumAuthenticator (SIWE) login-path matching flaw lets unauthenticated clients reach protected resources

Summary

Eclipse Jetty's EthereumAuthenticator (module org.eclipse.jetty:jetty-ethereum, Sign-In with Ethereum authentication) identifies the login page with an unanchored substring match. If the configured login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. The CNA (Eclipse Foundation) scores it CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H).

Affected

• org.eclipse.jetty:jetty-ethereum >= 12.1.0, <= 12.1.12 (per the CNA record)
• Versions after 12.1.12 are outside the affected range stated by the CNA; 12.1.13 and 12.1.14 are published on Maven Central

Impact

An unauthenticated client may access certain protected resources (authentication and role constraints bypassed). Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected. No exploitation in the wild is reported by the source. 0xCERT rates this High rather than Critical because the affected module has limited deployment.

Recommended actions

• Upgrade jetty-ethereum (and Jetty 12.1.x) to a release after 12.1.12
• Until upgraded, review protected routes whose paths contain the configured login path segment and add explicit constraints or rename the login path

Source & attribution

This 0xCERT advisory summarises a disclosure by the Eclipse Jetty project / Eclipse Foundation CNA (credits: 4ra1n, EQSTLab, 2REBCat): https://nvd.nist.gov/vuln/detail/CVE-2026-19863 ; https://github.com/jetty/jetty.project/security/advisories/GHSA-6m7j-pjmp-crgq. Details may change; refer to the original source for the authoritative record.