{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/jetty-jetty-ee9-security-12.0.0-12.0.35/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jetty jetty-security (9.4.0.v20161208-9.4.58.v20250814)","Jetty jetty-security (10.0.0-10.0.26)","Jetty jetty-security (11.0.0-11.0.26)","Jetty jetty-security (12.0.0-12.0.35)","Jetty jetty-ee8-security (12.0.0-12.0.35)","Jetty jetty-ee9-security (12.0.0-12.0.35)","Jetty jetty-security (12.1.0-12.1.9)","Jetty jetty-ee8-security (12.1.0-12.1.9)","Jetty jetty-ee9-security (12.1.0-12.1.9)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","authentication-bypass","java","jetty","iso-8859-1","character-encoding","cve"],"_cs_type":"advisory","_cs_vendors":["Eclipse"],"content_html":"\u003cp\u003eA critical vulnerability, CVE-2026-10050, has been identified in Eclipse Jetty's HTTP client, specifically within the \u003ccode\u003eDigestAuthentication.apply()\u003c/code\u003e method of the \u003ccode\u003ejetty-security\u003c/code\u003e and \u003ccode\u003ejetty-eeX-security\u003c/code\u003e components. The flaw stems from the incorrect use of \u003ccode\u003eStandardCharsets.ISO_8859_1\u003c/code\u003e encoding when computing Digest authentication response hashes. This lossy encoding silently replaces any character above U+00FF (e.g., Chinese, Japanese, Cyrillic, Arabic, Emoji) with a question mark (\u003ccode\u003e?\u003c/code\u003e), leading to identical hash contributions for diverse characters. An attacker with a known username can exploit this by replacing non-Latin-1 characters in a target's password with \u003ccode\u003e?\u003c/code\u003e characters to create a collision password, enabling them to bypass Digest authentication and impersonate the legitimate user. The vulnerability affects Jetty versions 9.4.0 through 9.4.58.v20250814, 10.0.0 through 10.0.26, 11.0.0 through 11.0.26, 12.0.0 through 12.0.35, and 12.1.0 through 12.1.9 across various security packages.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a web application or service that utilizes Eclipse Jetty's Digest Authentication for user login.\u003c/li\u003e\n\u003cli\u003eThe attacker obtains a valid username for a target user on the vulnerable system (e.g., via OSINT, credential stuffing, or brute-forcing usernames).\u003c/li\u003e\n\u003cli\u003eThe attacker determines that the target user likely has a password containing non-Latin-1 characters (e.g., from an international region or using emojis).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a \u0026quot;collision password\u0026quot; by replacing all non-Latin-1 characters (U+00FF and above) in the presumed original password with \u003ccode\u003e?\u003c/code\u003e characters.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a Digest authentication attempt to the vulnerable Jetty application, providing the known username and the crafted collision password.\u003c/li\u003e\n\u003cli\u003eDuring the authentication process, the Jetty client's \u003ccode\u003eDigestAuthentication.apply()\u003c/code\u003e method computes MD5-based Digest response hashes using the \u003ccode\u003eISO-8859-1\u003c/code\u003e character encoding.\u003c/li\u003e\n\u003cli\u003eDue to the lossy nature of \u003ccode\u003eISO-8859-1\u003c/code\u003e, both the legitimate password and the crafted collision password (where non-Latin-1 characters are replaced by \u003ccode\u003e?\u003c/code\u003e) produce identical Digest response hashes.\u003c/li\u003e\n\u003cli\u003eThe vulnerable Jetty server validates this identical Digest response hash, thereby authenticating the attacker as the legitimate user, achieving an authentication bypass.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability presents two significant impacts. Firstly, it allows for \u003cstrong\u003eauthentication bypass\u003c/strong\u003e (CVE-2026-10050). If a service using Jetty's Digest authentication has users with passwords containing non-Latin-1 characters (e.g., Chinese, Japanese, Korean, Cyrillic, Arabic, Greek, or Latin Extended characters above U+00FF, including many accented European characters or emojis), an attacker can successfully authenticate as that user. This is achieved by knowing the username and crafting a collision password where all non-Latin-1 characters are replaced with \u003ccode\u003e?\u003c/code\u003e, which generates the same Digest hash. Secondly, this flaw can lead to a \u003cstrong\u003edenial of service for legitimate users\u003c/strong\u003e. Since Jetty's Digest client computes hashes using ISO-8859-1, legitimate users with non-ASCII (Latin-1+) characters in their passwords will have their bytes differ from UTF-8 hashes stored on the server side. Consequently, these legitimate users will be unable to successfully authenticate via Digest authentication, even if their password is correct, effectively locking them out of their accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-10050\u003c/strong\u003e immediately by upgrading all affected Eclipse Jetty installations to fixed versions. Consult the vendor advisory for specific patch versions for \u003ccode\u003ejetty-security\u003c/code\u003e, \u003ccode\u003ejetty-ee8-security\u003c/code\u003e, and \u003ccode\u003ejetty-ee9-security\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAvoid using Digest authentication in environments where users may have passwords containing non-Latin-1 characters. Consider migrating to stronger, less error-prone authentication mechanisms like modern token-based authentication (e.g., OAuth 2.0, OpenID Connect) or certificate-based authentication.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for repeated failed authentication attempts followed by a sudden success for accounts that typically use non-Latin-1 characters in their usernames, or for authentication attempts using unusual password patterns that might correspond to the \u003ccode\u003e?\u003c/code\u003e character substitution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T22:56:47Z","date_published":"2026-07-22T22:56:47Z","id":"https://feed.craftedsignal.io/briefs/2026-07-jetty-digest-auth-bypass/","summary":"A vulnerability, CVE-2026-10050, in Eclipse Jetty's HTTP client `DigestAuthentication.apply()` method allows an authentication bypass by an attacker who can exploit the lossy ISO-8859-1 character encoding to forge Digest authentication response hashes for users with non-Latin-1 passwords.","title":"Eclipse Jetty Digest Authentication Bypass via ISO-8859-1 Encoding Flaw (CVE-2026-10050)","url":"https://feed.craftedsignal.io/briefs/2026-07-jetty-digest-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Jetty Jetty-Ee9-Security (12.0.0-12.0.35)","version":"https://jsonfeed.org/version/1.1"}