CVE-2026-76184

{
  "etk_id": "ETK-2026-1663",
  "cve_id": "CVE-2026-76184",
  "display_id": "CVE-2026-76184",
  "ghsa_id": "GHSA-qfr2-43g5-g768",
  "euvd_id": "EUVD-2026-101946",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Redirect path normalization credential leak in Jetty HttpClient",
  "summary": "Jetty HttpClient may evaluate credential scope against an unnormalized redirect path. An attacker who controls redirects and operates an application on the same domain may cause credentials intended for one path to be sent to a different path.",
  "mitigation": "No fixed release is recorded. Restrict or disable redirects from untrusted endpoints, and avoid using path-scoped credentials with affected HttpClient requests where possible.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse Jetty",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.1.0, <= 12.1.12",
        ">= 12.0.0, <= 12.0.38",
        ">= 11.0.0, <= 11.0.32",
        ">= 10.0.0, <= 10.0.32",
        ">= 9.4.0, <= 9.4.64"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "org.eclipse.jetty:jetty-client",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0028,
  "epss_percentile": 0.1906,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.946587083333334,
  "t0_at": "2026-10-15T08:46:54.683000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T08:46:54.683000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T08:46:54.683000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76184"
    }
  }
}