CVE-2026-5795
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-226
Información sensible no eliminada antes de su liberación
Fecha de publicación:
08/04/2026
Última modificación:
08/04/2026
Descripción
*** Pendiente de traducción *** In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.<br />
<br />
<br />
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.<br />
<br />
<br />
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Impacto
Puntuación base 3.x
7.40
Gravedad 3.x
ALTA