CVE-2026-5795
Severity CVSS v4.0:
Pending analysis
Type:
CWE-226
Sensitive Information in Resource Not Removed Before Reuse
Publication date:
08/04/2026
Last modified:
08/04/2026
Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.<br />
<br />
<br />
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.<br />
<br />
<br />
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Impact
Base Score 3.x
7.40
Severity 3.x
HIGH