Cyber Resilience

CVE-2026-10050

Auth Bypass in Eclipse Jetty 9.4.0 – 9.4.63

Public PoCAuth Bypass
Published
04 August 2026
Modified
08 August 2026
Patch / advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0047 38th percentile
Risk Priority 45 floored blend · peak EPSS

Summary

CVE-2026-10050 is a high-severity Improper Handling of Alternate Encoding (CWE-173) vulnerability in Eclipse Jetty. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical…

more

reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1027 Obfuscated Files or Information Stealth
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-8384Same product: Eclipse Jetty
CVE-2024-6763Same product: Eclipse Jetty
CVE-2026-2332Same product: Eclipse Jetty
CVE-2024-13009Same product: Eclipse Jetty
CVE-2026-6790Same product: Eclipse Jetty
CVE-2025-11143Same product: Eclipse Jetty
CVE-2026-5795Same product: Eclipse Jetty
CVE-2026-1605Same product: Eclipse Jetty
CVE-2026-10051Same product: Eclipse Jetty
CVE-2025-5115Same product: Eclipse Jetty

Affected Assets

eclipse
jetty
9.4.0 — 9.4.63 · 10.0.0 — 10.0.31 · 11.0.0 — 11.0.31

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.3.3
  • V1.3.10
  • V1.1.2
  • V1.2.2

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation at post-design stages directly uncovers incorrect implementations of required authentication algorithms.

Input validation that checks validity of supplied data directly stops alternate encodings from bypassing intended filters or logic.

Requiring documented development processes, standards, and tools reduces the chance that an established authentication algorithm is coded incorrectly.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper input validation and canonicalization to handle alternate encodings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Secure authentication control directly requires correct implementation of authentication algorithms.

finds

Security testing can detect encoding-handling defects but does not itself implement the preventive coding controls.

degrades

Cryptography control addresses proper use of authentication algorithms but is broader than authentication alone.

prevents

Secure development lifecycle includes verification steps that can catch incorrect authentication implementations.

prevents

Application security requirements can mandate canonicalization and encoding validation to prevent alternate-encoding bypasses.

prevents

Secure architecture principles include input normalization and canonicalization controls that mitigate encoding-related weaknesses.

References