Bug 2553175 (CVE-2026-19864)

Summary: CVE-2026-19864 org.eclipse.jetty/jetty-security: Eclipse Jetty: Plaintext password disclosure via session persistence
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, anthomas, asyoung, ataylor, ccranfor, csuconic, dbruscin, dfreiber, drow, ehelms, ewittman, fmariani, ggainey, ggrzybek, gmalinko, gtully, janstey, jburrell, jhollowa, jpasqual, jpechane, jraez, jsherman, juwatts, jwon, kaycoth, kvanderr, mcarlett, mdellweg, mhulan, nipatil, nmoumoul, osousa, pantinor, parichar, pcreech, pdelbell, pjindal, prichard, rchan, rgemmell, rgodfrey, rhel-process-autobot, rkubis, rstepani, sdawley, smallamp, sthirugn, tasato, tbish, tcunning, tlavocat, tmalecek, vkumar, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can exploit this flaw to obtain the plaintext passwords of authenticated users.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-15 09:51:52 UTC 
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.



An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.