-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0243
============================================================

Advisory-ID:  0xCERT-2026-0243
Severity:     High
Published:    2026-10-15T10:17:12.000Z
Updated:      2026-10-15T12:36:53.879Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0243

Title: Jetty EthereumAuthenticator (SIWE) login-path matching flaw lets unauthenticated clients reach protected resources

Summary
- -------
Eclipse Jetty's jetty-ethereum EthereumAuthenticator 12.1.0–12.1.12 matches the login path as an unanchored substring, so protected routes containing the login path as a later segment can be reached without authentication. Upgrade beyond 12.1.12.

Details
- -------
Summary
Eclipse Jetty's EthereumAuthenticator (module org.eclipse.jetty:jetty-ethereum, Sign-In with Ethereum authentication) identifies the login page with an unanchored substring match. If the configured login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. The CNA (Eclipse Foundation) scores it CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H).

Affected
- - org.eclipse.jetty:jetty-ethereum >= 12.1.0, <= 12.1.12 (per the CNA record)
- - Versions after 12.1.12 are outside the affected range stated by the CNA; 12.1.13 and 12.1.14 are published on Maven Central

Impact
An unauthenticated client may access certain protected resources (authentication and role constraints bypassed). Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected. No exploitation in the wild is reported by the source. 0xCERT rates this High rather than Critical because the affected module has limited deployment.

Recommended actions
- - Upgrade jetty-ethereum (and Jetty 12.1.x) to a release after 12.1.12
- - Until upgraded, review protected routes whose paths contain the configured login path segment and add explicit constraints or rename the login path

Source & attribution
This 0xCERT advisory summarises a disclosure by the Eclipse Jetty project / Eclipse Foundation CNA (credits: 4ra1n, EQSTLab, 2REBCat): https://nvd.nist.gov/vuln/detail/CVE-2026-19863 ; https://github.com/jetty/jetty.project/security/advisories/GHSA-6m7j-pjmp-crgq. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://nvd.nist.gov/vuln/detail/CVE-2026-19863
- - CVE-2026-19863
- - GHSA-6m7j-pjmp-crgq
- - https://github.com/jetty/jetty.project/security/advisories/GHSA-6m7j-pjmp-crgq
- - https://gitlab.eclipse.org/security/cve-assignment/-/work_items/230

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrRZuQJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdWqekQ9bk8sfi1MYP9aEw7Klj+bO+8r3ttkkuF
WsOemRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADWyQEAneV2FmaqdqteSsSJ
FKAS6X9iYME65rQQtMczq5JL37UBAKuk6IIpdUH/cNzGkwTOkNCDYkFUPkWn
4HrpdUk1GHcG
=gJge
-----END PGP SIGNATURE-----