Read the docs
TI-2023-22292 Aliases CVE-2023-41900GHSA-pwh8-58vv-vw48

Jetty's OpenId Revoked authentication allows one request

Priority LOW 22CWE-1390Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00914 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-openid (Maven): 9.4.52.v20230823, 10.0.16, 11.0.16Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationjetty.project9.4.21 – 9.4.51; 10.0.0 – 10.0.15; 11.0.0 – 11.0.15—No fix listedCNA
—org.eclipse.jetty:jetty-openid (Maven)9.4.21 to before 9.4.52.v202308239.4.52.v20230823Patch availableGHSA-pwh8-58vv-vw48
—org.eclipse.jetty:jetty-openid (Maven)10.0.0 to before 10.0.1610.0.16Patch availableGHSA-pwh8-58vv-vw48
—org.eclipse.jetty:jetty-openid (Maven)11.0.0 to before 11.0.1611.0.16Patch availableGHSA-pwh8-58vv-vw48
  • jetty.project VendorEclipse Foundation Affected 9.4.21 – 9.4.51; 10.0.0 – 10.0.15; 11.0.0 – 11.0.15 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-openid (Maven) Vendor— Affected 9.4.21 to before 9.4.52.v20230823 Fixed in 9.4.52.v20230823 Patch available GHSA-pwh8-58vv-vw48
  • org.eclipse.jetty:jetty-openid (Maven) Vendor— Affected 10.0.0 to before 10.0.16 Fixed in 10.0.16 Patch available GHSA-pwh8-58vv-vw48
  • org.eclipse.jetty:jetty-openid (Maven) Vendor— Affected 11.0.0 to before 11.0.16 Fixed in 11.0.16 Patch available GHSA-pwh8-58vv-vw48

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.21 to before 9.4.52; 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16VulnerableEclipse Foundation
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.21 to before 9.4.52; 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-pwh8-58vv-vw48 org.eclipse.jetty:jetty-openid (Maven) Fixed in 9.4.52.v20230823 Advisory →
  • Fix · GHSA-pwh8-58vv-vw48 org.eclipse.jetty:jetty-openid (Maven) Fixed in 10.0.16 Advisory →
  • Fix · GHSA-pwh8-58vv-vw48 org.eclipse.jetty:jetty-openid (Maven) Fixed in 11.0.16 Advisory →

Red Hat 1 advisory

  • RHSA-2023:7247 Released 2023-11-15 · Red Hat rating Critical
    Red Hat Fuse 7.12.1 release and security update
    • Red Hat Fuse 7.12.1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.12.1Fixed RHSA-2023:7247
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41900
  2. 2026-10-03 Alias added: GHSA-pwh8-58vv-vw48

References

Exploit 1

Patch 2

Advisory 3

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences