CVE-2026-76184

EUVD-2026-101946

15.10.2026, 09:17

In Eclipse Jetty, HttpClient may receive a redirect of the form:



```



/secure/../evil



```



If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.



This also mean that the attacker must have an evil application deployed on the same domain as the target.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
eclipse	CNA	8.2 HIGH	NETWORK	HIGH	NONE	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 18.9%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
eclipse	jetty	12.1.0 ≤ 𝑥 ≤ 12.1.12	CNA
eclipse	jetty	12.0.0 ≤ 𝑥 ≤ 12.0.38	CNA
eclipse	jetty	11.0.0 ≤ 𝑥 ≤ 11.0.32	CNA
eclipse	jetty	10.0.0 ≤ 𝑥 ≤ 10.0.32	CNA
eclipse	jetty	9.4.0 ≤ 𝑥 ≤ 9.4.64	CNA