{"id":"CVE-2023-41900","aliases":["CLSA-2026-1767658110","CLSA-2026-1778546718","CLSA-2026-1779842950","CLSA-2026-1794234057","CLSA-2026-1794238093","CLSA-2026-1794240586","CLSA-2026-1794244898","CLSA-2026-1794251641","DEBIAN-CVE-2023-41900","DSA-5507-1","EUVD-2023-2569","GHSA-58qw-p7qm-5rvh","GHSA-pwh8-58vv-vw48","SUSE-SU-2023:4210-1","UBUNTU-CVE-2023-41900","openSUSE-SU-2024:13329-1"],"status":"published","title":"Jetty's OpenId Revoked authentication allows one request","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00914,"percentile":0.60534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1390","CWE-287","CWE-611"],"published":"2023-07-10T21:52:39Z","modified":"2026-11-10T01:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","fixed_in":["11.0.16","10.0.16","12.0.0","9.4.52.v20230823"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","fixed_in":["9.4.52.v20230823","10.0.16","11.0.16"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","fixed_in":["9.4.62.tuxcare0003","9.4.61.tuxcare0004"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jetty9","fixed_in":["9.4.50-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jetty9","fixed_in":["9.4.52-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty9","fixed_in":["9.4.52-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-alpha0"},{"last_affected":"11.0.15"},{"fixed":"11.0.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-alpha0"},{"last_affected":"10.0.15"},{"fixed":"10.0.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0.alpha0"},{"last_affected":"12.0.0.beta4"},{"fixed":"12.0.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.4.51"},{"fixed":"9.4.52.v20230823"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.21"},{"last_affected":"9.4.51"},{"fixed":"9.4.52.v20230823"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.15"},{"fixed":"10.0.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.15"},{"fixed":"11.0.16"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.1"}]}],"versions":["9.4.24.v20191120"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.1"}]}],"versions":["9.4.24.v20191120"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.1"}]}],"versions":["9.4.50.v20221201"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.62"},{"fixed":"9.4.62.tuxcare0003"}]}],"versions":["9.4.62","9.4.62.tuxcare0001","9.4.62.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.61"},{"fixed":"9.4.61.tuxcare0004"}]}],"versions":["9.4.61","9.4.61.tuxcare0001","9.4.61.tuxcare0002","9.4.61.tuxcare0003"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0004"}]}],"versions":["9.4.60","9.4.60.tuxcare0001","9.4.60.tuxcare0002","9.4.60.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0004"}]}],"versions":["9.4.60","9.4.60.tuxcare0001","9.4.60.tuxcare0002","9.4.60.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.58.v20250814"},{"fixed":"9.4.58.v20250814-tuxcare.8"}]}],"versions":["9.4.58.v20250814","9.4.58.v20250814-tuxcare.1","9.4.58.v20250814-tuxcare.2","9.4.58.v20250814-tuxcare.3","9.4.58.v20250814-tuxcare.4","9.4.58.v20250814-tuxcare.5","9.4.58.v20250814-tuxcare.6","9.4.58.v20250814-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.58.v20250814"},{"fixed":"9.4.58.v20250814-tuxcare.8"}]}],"versions":["9.4.58.v20250814","9.4.58.v20250814-tuxcare.1","9.4.58.v20250814-tuxcare.2","9.4.58.v20250814-tuxcare.3","9.4.58.v20250814-tuxcare.4","9.4.58.v20250814-tuxcare.5","9.4.58.v20250814-tuxcare.6","9.4.58.v20250814-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.50-4+deb12u1"}]}],"versions":["9.4.50-4"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-3+deb11u2"}]}],"versions":["9.4.39-3","9.4.39-3+deb11u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.50-4+deb12u1"}]}],"versions":["9.4.50-4"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-alpha0"},{"fixed":"10.0.16"}]}],"versions":["10.0.0","10.0.0-alpha0","10.0.0.alpha1","10.0.0.alpha2","10.0.0.beta0","10.0.0.beta1","10.0.0.beta2","10.0.0.beta3","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-alpha0"},{"fixed":"11.0.16"}]}],"versions":["11.0.0","11.0.0-alpha0","11.0.0.beta1","11.0.0.beta2","11.0.0.beta3","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0.alpha0"},{"fixed":"12.0.0"}]}],"versions":["12.0.0.alpha0","12.0.0.alpha1","12.0.0.alpha2","12.0.0.alpha3","12.0.0.beta0","12.0.0.beta1","12.0.0.beta2","12.0.0.beta3","12.0.0.beta4"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.52.v20230823"}]}],"versions":["7.0.0.M0","7.0.0.M1","7.0.0.M2","7.0.0.M3","7.0.0.M4","7.0.0.RC0","7.0.0.RC1","7.0.0.RC2","7.0.0.RC3","7.0.0.RC4","7.0.0.RC5","7.0.0.RC6","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2","8.1.0.RC4","8.1.0.RC5","8.1.0.v20120127","8.1.1.v20120215","8.1.10.v20130312","8.1.11.v20130520","8.1.12.v20130726","8.1.13.v20130916","8.1.14.v20131031","8.1.15.v20140411","8.1.16.v20140903","8.1.17.v20150415","8.1.18.v20150929","8.1.19.v20160209","8.1.2.v20120308","8.1.20.v20160902","8.1.21.v20160908","8.1.22.v20160922","8.1.3.v20120416","8.1.4.v20120524","8.1.5.v20120716","8.1.6.v20120903","8.1.7.v20120910","8.1.8.v20121106","8.1.9.v20130131","8.2.0.v20160908","9.0.0.M0","9.0.0.M1","9.0.0.M2","9.0.0.M3","9.0.0.M4","9.0.0.M5","9.0.0.RC0","9.0.0.RC1","9.0.0.RC2","9.0.0.v20130308","9.0.1.v20130408","9.0.2.v20130417","9.0.3.v20130506","9.0.4.v20130625","9.0.5.v20130815","9.0.6.v20130930","9.0.7.v20131107","9.1.0.M0","9.1.0.RC0","9.1.0.RC1","9.1.0.RC2","9.1.0.v20131115","9.1.1.v20140108","9.1.2.v20140210","9.1.3.v20140225","9.1.4.v20140401","9.1.5.v20140505","9.1.6.v20160112","9.2.0.M0","9.2.0.M1","9.2.0.RC0","9.2.0.v20140526","9.2.1.v20140609","9.2.10.v20150310","9.2.11.M0","9.2.11.v20150529","9.2.12.M0","9.2.12.v20150709","9.2.13.v20150730","9.2.14.v20151106","9.2.15.v20160210","9.2.16.v20160414","9.2.17.v20160517","9.2.18.v20160721","9.2.19.v20160908","9.2.2.v20140723","9.2.20.v20161216","9.2.21.v20170120","9.2.22.v20170606","9.2.23.v20171218","9.2.24.v20180105","9.2.25.v20180606","9.2.26.v20180806","9.2.27.v20190403","9.2.28.v20190418","9.2.29.v20191105","9.2.3.v20140905","9.2.30.v20200428","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217","9.2.9.v20150224","9.3.0.M0","9.3.0.M1","9.3.0.M2","9.3.0.RC0","9.3.0.RC1","9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.21"},{"fixed":"9.4.52.v20230823"}]}],"versions":["9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.50.v20221201","9.4.51.v20230217"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.16"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.16"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.53-150200.3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse","product":"jetty.project"}],"references":[{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/eclipse/jetty.project/pull/9528","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse/jetty.project/pull/9660","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://www.debian.org/security/2023/dsa-5507","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/pull/10067","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.0","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh","tags":["web"]},{"url":"https://github.com/advisories/GHSA-58qw-p7qm-5rvh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41900","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pwh8-58vv-vw48"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41900.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41900","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234210-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215415","tags":["report"]},{"url":"https://bugzilla.suse.com/1215416","tags":["report"]},{"url":"https://bugzilla.suse.com/1215417","tags":["report"]},{"url":"https://bugzilla.suse.com/1216162","tags":["report"]},{"url":"https://bugzilla.suse.com/1216169","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-41900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41900","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-41900","title":"Jetty's OpenId Revoked authentication allows one request","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","status":"published","published":"2023-09-15T20:17:42.201Z","modified":"2025-02-13T17:09:04.719Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-2569","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","status":"published","published":"2023-09-15T20:17:42Z","modified":"2025-02-13T17:09:04Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:03:49.098775Z"}],"ghsa":[{"id":"GHSA-58qw-p7qm-5rvh","title":"Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations","description":"### From the reporter\n\n\u003e `XmlParser` is vulnerable to XML external entity (XXE) vulnerability.\n\u003e  XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit\n\u003e this vulnerability in order to achieve SSRF or cause a denial of service.\n\u003e One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the\n\u003e WAR includes a malicious web.xml.\n\n### Impact\nThere are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit `XmlParser` the attacker would already have the ability to deploy and execute hostile code.  Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation.  \n\nThus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser.  No CVE will be allocated to this advisory.\n\nHowever, any direct usage of the `XmlParser` class by an application may be vulnerable.  The impact would greatly depend on how the application uses `XmlParser`, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.\n\n### Patches\nAbility to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067\n\n### Workarounds\nDon't use Jetty's `XmlParser` to parse data from users.","status":"published","published":"2023-07-10T21:52:39Z","modified":"2026-02-10T20:06:18Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:39:24.742346Z"},{"id":"GHSA-pwh8-58vv-vw48","title":"Jetty's OpenId Revoked authentication allows one request","description":"If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. \n\nSo a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`.\n\n### Impact\nThis impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users.\n\n### Original Report\n\u003e working on a custom OpenIdAuthenticator, I discovered the following:\n\u003e \n\u003e https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505\n\u003e \n\u003e In the case where the LoginService does return that the authentication has been revoked (from the validate() call on line 463), the OpenIdAuthenticator removes the authentication from the session; however the current request still proceeds as if authenticated, since it falls through to \"return authentication\" on line 505.\n\u003e \n\u003e This is fixed by moving the line 505 (and associated debug log) inside the else block that ends on line 502, instead of outside it. Then the revocation case will run through to line 517 and will trigger a new OpenId authentication which I think is correct.\n\u003e \n\u003e I think this revocation can only occur if you do attach a separate LoginService to the OpenIdLoginService, but in that case the revoked authentication will still let the next request through (and possibly more than one if they are very close to simultaneous).\n\u003e \n\u003e Technically I think this is a security vulnerability, if a very minor one, so I'm sending this off-list.\n\n### Patched Versions\n\nFixed in Jetty Versions:\n* 9.4.52 - fixed in PR https://github.com/eclipse/jetty.project/pull/9660\n* 10.0.16 - fixed in PR https://github.com/eclipse/jetty.project/pull/9528\n* 11.0.16 - fixed in PR https://github.com/eclipse/jetty.project/pull/9528\n* 12.0.0 - not impacted (already has fix)\n\n### Workaround\nUpgrade your version of Jetty.\n\n### References\n* https://github.com/eclipse/jetty.project/pull/9528\n* https://github.com/eclipse/jetty.project/pull/9660","status":"published","published":"2023-09-15T13:36:10Z","modified":"2024-09-10T17:15:26Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-287","CWE-1390"],"updated_at":"2026-11-02T14:38:02.014847Z"}],"nvd":[{"id":"CVE-2023-41900","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","status":"published","published":"2023-09-15T21:15:11.6Z","modified":"2026-06-17T06:23:02.29Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1390","CWE-287"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-41900","title":"Jetty's OpenId Revoked authentication allows one request","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","status":"published","published":"2023-09-15T20:17:42.201Z","modified":"2026-10-28T02:30:37.041561186Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-41900","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","status":"published","published":"2023-09-15T21:15:11.6Z","modified":"2026-10-26T18:03:06.392588617Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-58qw-p7qm-5rvh","title":"Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations","description":"### From the reporter\n\n\u003e `XmlParser` is vulnerable to XML external entity (XXE) vulnerability.\n\u003e  XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit\n\u003e this vulnerability in order to achieve SSRF or cause a denial of service.\n\u003e One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the\n\u003e WAR includes a malicious web.xml.\n\n### Impact\nThere are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit `XmlParser` the attacker would already have the ability to deploy and execute hostile code.  Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation.  \n\nThus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser.  No CVE will be allocated to this advisory.\n\nHowever, any direct usage of the `XmlParser` class by an application may be vulnerable.  The impact would greatly depend on how the application uses `XmlParser`, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.\n\n### Patches\nAbility to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067\n\n### Workarounds\nDon't use Jetty's `XmlParser` to parse data from users.","status":"published","published":"2023-07-10T21:52:39Z","modified":"2026-09-10T03:50:08.640067019Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-pwh8-58vv-vw48","title":"Jetty's OpenId Revoked authentication allows one request","description":"If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. \n\nSo a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`.\n\n### Impact\nThis impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users.\n\n### Original Report\n\u003e working on a custom OpenIdAuthenticator, I discovered the following:\n\u003e \n\u003e https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505\n\u003e \n\u003e In the case where the LoginService does return that the authentication has been revoked (from the validate() call on line 463), the OpenIdAuthenticator removes the authentication from the session; however the current request still proceeds as if authenticated, since it falls through to \"return authentication\" on line 505.\n\u003e \n\u003e This is fixed by moving the line 505 (and associated debug log) inside the else block that ends on line 502, instead of outside it. Then the revocation case will run through to line 517 and will trigger a new OpenId authentication which I think is correct.\n\u003e \n\u003e I think this revocation can only occur if you do attach a separate LoginService to the OpenIdLoginService, but in that case the revoked authentication will still let the next request through (and possibly more than one if they are very close to simultaneous).\n\u003e \n\u003e Technically I think this is a security vulnerability, if a very minor one, so I'm sending this off-list.\n\n### Patched Versions\n\nFixed in Jetty Versions:\n* 9.4.52 - fixed in PR https://github.com/eclipse/jetty.project/pull/9660\n* 10.0.16 - fixed in PR https://github.com/eclipse/jetty.project/pull/9528\n* 11.0.16 - fixed in PR https://github.com/eclipse/jetty.project/pull/9528\n* 12.0.0 - not impacted (already has fix)\n\n### Workaround\nUpgrade your version of Jetty.\n\n### References\n* https://github.com/eclipse/jetty.project/pull/9528\n* https://github.com/eclipse/jetty.project/pull/9660","status":"published","published":"2023-09-15T13:36:10Z","modified":"2026-09-10T03:50:03.352500057Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-1390","CWE-287"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2023-41900","description":"Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.","status":"published","published":"2023-09-15T21:15:00Z","modified":"2025-10-24T05:02:15Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2026-1767658110","title":"TuxCare security update for org.eclipse.jetty (3 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 3 CVEs. Fixed in 9.4.24.v20191120-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.283217921Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1778546718","title":"TuxCare security update for 7 packages (14 CVEs)","description":"TuxCare rebuilt 7 packages to address 14 CVEs. Fixed in 9.4.50.v20221201-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-11-02T19:45:28.96509752Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1779842950","title":"TuxCare security update for 5 packages (5 CVEs)","description":"TuxCare rebuilt 5 packages to address 5 CVEs. Fixed in 9.4.48.v20220622-tuxcare.2.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-11-02T19:45:31.791639216Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1794234057","title":"TuxCare security update for org.eclipse.jetty:jetty-openid (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-openid to address 1 CVE. Fixed in 9.4.62.tuxcare0003.","status":"published","published":"2026-11-09T15:20:58Z","modified":"2026-11-09T19:15:07.637867875Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794238093","title":"TuxCare security update for org.eclipse.jetty:jetty-openid (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-openid to address 1 CVE. Fixed in 9.4.61.tuxcare0004.","status":"published","published":"2026-11-09T16:28:14Z","modified":"2026-11-09T19:15:07.740505663Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794240586","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.60.tuxcare0004.","status":"published","published":"2026-11-09T17:09:47Z","modified":"2026-11-09T19:15:15.029692942Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794244898","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.58.v20250814-tuxcare.8.","status":"published","published":"2026-11-09T18:21:39Z","modified":"2026-11-10T01:15:03.447684541Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794251641","title":"TuxCare security update for 5 packages (5 CVEs)","description":"TuxCare rebuilt 5 packages to address 5 CVEs. Fixed in 9.4.51.v20230217-tuxcare.2.","status":"published","published":"2026-11-09T20:14:02Z","modified":"2026-11-10T01:15:05.398922343Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"DSA-5507-1","title":"jetty9 - security update","status":"published","published":"2023-09-28T00:00:00Z","modified":"2026-03-09T02:10:45.628448Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13329-1","title":"jetty-annotations-9.4.53-1.1 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.53-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:29.247654Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4210-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\n- Updated to version 9.4.53.v20231009:\n\n  - CVE-2023-44487: Fixed a potential denial of service scenario via\n    RST frame floods (bsc#1216169).\n  - CVE-2023-36478: Fixed an integer overflow in the HTTP/2 HPACK\n    decoder (bsc#1216162).\n  - CVE-2023-40167: Fixed a permissive HTTP header parsing issue that\n    could potentially lead to HTTP smuggling attacks (bsc#1215417).\n  - CVE-2023-36479: Fixed an incorrect command execution when sending\n    requests with certain characters in requested filenames\n    (bsc#1215415).\n  - CVE-2023-41900: Fixed an issue where an invalidated session would\n    be allowed to perform a single request (bsc#1215416).\n","status":"published","published":"2023-10-26T08:26:33Z","modified":"2026-02-04T03:26:32.540625Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}