Eclipse Jetty Digest Authentication Bypass via Character Substitution

Overview

CVE-2026-10050 is a critical vulnerability in the Eclipse Jetty framework, specifically affecting its Digest authentication mechanism. This vulnerability allows an attacker to bypass authentication for users with passwords containing non-Latin-1 characters. The issue stems from Jetty's use of ISO-8859-1 encoding, which silently replaces characters outside the Latin-1 range (U+0000–U+00FF) with the byte `0x3F` (`?`). This replacement leads to collisions in the Digest authentication response hashes, effectively allowing an attacker to authenticate as a user without knowing their actual password.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability lies in the `DigestAuthentication.apply()` method of Jetty's HTTP client. Specifically, the method uses `getBytes(StandardCharsets.ISO_8859_1)` to compute Digest authentication response hashes. This encoding scheme is problematic because it cannot represent characters outside the U+0000–U+00FF range. As a result, any character outside this range is replaced with `0x3F` (`?`), causing all such characters to produce identical hash contributions. This vulnerability belongs to the CWE-311 category, which involves cleartext storage of sensitive information, but more accurately, it relates to CWE-327, the use of a broken or risky cryptographic algorithm (in this case, MD5) and CWE-601, URL Redirection to Untrusted Site ('Open Redirect'). However, the primary issue here is the insecure use of ISO-8859-1 encoding in authentication.

Attack Surface & Vector

The attack surface for this vulnerability involves any application using Jetty for Digest authentication where a user has a non-Latin-1 password. The attack vector is relatively straightforward: an attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with `?` characters. The attacker does not need any special privileges or access to the system other than the ability to submit authentication requests.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Authentication Bypass via Character Substitution 1. Initial Position: The attacker knows a valid username for a service using Jetty for Digest authentication. 2. Triggering the Flaw: The attacker crafts a collision password where all non-Latin-1 characters are replaced with `?`. For example, if the original password is `我爱Java!密码123★`, the collision password would be `??Java!??123?`. 3. What Breaks: When the attacker submits the collision password, Jetty's Digest authentication mechanism computes the response hash using ISO-8859-1 encoding. Because all non-Latin-1 characters are replaced with `?`, the resulting hash is identical to the one that would be generated using the original password. This causes the authentication mechanism to succeed, allowing the attacker to authenticate as the user. 4. Attacker's Prize: The attacker gains unauthorized access to the user's account, potentially leading to data theft, lateral movement within the network, or other malicious activities.

Real-World Impact

The impact of this vulnerability is significant. Any service using Jetty for Digest authentication is potentially vulnerable to authentication bypass attacks. This affects users with passwords containing non-Latin-1 characters, which includes a wide range of languages such as Chinese, Japanese, Korean, Cyrillic, Arabic, Greek, and many others. Furthermore, this vulnerability also causes a denial of service for non-Latin-1 users, as they will be unable to authenticate even with their correct passwords.

Detection & Defense

Immediate Mitigations

- Upgrade to a version of Jetty that fixes this vulnerability (if available). - Use a different authentication mechanism that does not rely on Digest authentication. - Implement additional security measures such as IP restrictions or multi-factor authentication to reduce the risk.

Detection Strategies

- Monitor authentication logs for unusual patterns or repeated failed login attempts. - Implement SIEM rules to detect and alert on potential authentication bypass attempts. - Use network intrusion detection systems to identify suspicious traffic.

Long-Term Hardening

- Use secure password storage mechanisms that can handle a wide range of characters properly. - Consider using more secure authentication protocols that are less susceptible to these types of attacks. - Regularly update and patch Jetty and other dependencies to ensure you have the latest security fixes.

Key Takeaways

- CVE-2026-10050 is a critical authentication bypass vulnerability in Eclipse Jetty's Digest authentication implementation. - The vulnerability is caused by the insecure use of ISO-8859-1 encoding, leading to collisions in Digest authentication response hashes. - Attackers can bypass authentication for users with non-Latin-1 passwords by substituting non-Latin-1 characters with `?`. - This vulnerability also results in a denial of service for users with non-Latin-1 passwords. - Immediate mitigations include upgrading to a fixed version of Jetty, using alternative authentication mechanisms, and enhancing security with additional measures.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-2fvj-hgj9-j2gr