CVE-2026-10050 Overview
CVE-2026-10050 affects the Digest authentication server-side component in Eclipse Jetty. The component uses ISO-8859-1 to encode password bytes, which cannot represent characters from Chinese, Cyrillic, Greek, and other non-Latin alphabets. Jetty silently replaces unsupported characters with ? placeholders during encoding. An attacker can craft a Digest Authorization header using only ? characters and match any password of equal length that contains non-ISO-8859-1 characters. This weakness enables authentication bypass against accounts protected by passwords using international characters. The vulnerability is classified under [CWE-173] (Improper Handling of Alternate Encoding).
Critical Impact
Attackers can bypass Digest authentication for any account whose password consists entirely of non-ISO-8859-1 characters, gaining unauthorized access to protected resources.
Affected Products
- Eclipse Jetty (Digest authentication server-side component)
- Jetty deployments relying on HTTP Digest authentication for access control
- Applications using Jetty with passwords containing non-Latin characters
Discovery Timeline
- 2026-08-04 - CVE-2026-10050 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-10050
Vulnerability Analysis
The flaw resides in how Jetty's Digest authentication implementation encodes user passwords into bytes before computing the authentication hash. Jetty applies ISO-8859-1 encoding, a single-byte character set limited to Latin-1 characters. When a password contains characters outside this range, such as αβ123, the encoder replaces each unsupported character with the ASCII question mark ?, yielding ??123.
The Digest authentication protocol computes HA1 = MD5(username:realm:password). Because the server derives HA1 from the substituted password, any password of the same length composed entirely of non-ISO-8859-1 characters produces the same digest. An attacker who knows only the password length and character class can supply ? characters and successfully authenticate.
HTTP Digest as defined in RFC-7616 introduced a charset parameter defaulting to UTF-8, which correctly represents international characters. Jetty's legacy encoding predates this specification.
Root Cause
The root cause is improper handling of alternate character encodings [CWE-173]. The server assumes ISO-8859-1 for password bytes, a historical default from early HTTP specifications that did not mandate a charset. Silent lossy substitution during encoding collapses the effective keyspace for internationalized passwords.
Attack Vector
Exploitation requires only network access to a Jetty endpoint protected by Digest authentication. The attacker sends an HTTP request with an Authorization: Digest header where the password field is filled with ? characters matching the length of the target credential. If the target account uses a password composed of non-ISO-8859-1 characters, the server's substitution logic converts it into an identical ? string, and the digest comparison succeeds.
No user interaction, privileges, or authentication is required. The attack is deterministic against affected accounts and does not depend on brute forcing the full password space.
See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-10050
Indicators of Compromise
- Successful Digest authentication events from unfamiliar source IP addresses targeting accounts known to use non-Latin passwords.
- HTTP Authorization: Digest headers containing password-related fields matching patterns of repeated ? substitutions after decoding.
- Repeated authentication attempts with varying Authorization header lengths against the same user, suggestive of length probing.
Detection Strategies
- Inspect Jetty access logs for 401 to 200 transitions on Digest-protected endpoints from previously unseen clients.
- Audit user directories to enumerate accounts whose passwords include characters outside the ISO-8859-1 range and flag their login events.
- Correlate Digest authentication successes with the character composition of stored passwords to identify anomalous matches.
Monitoring Recommendations
- Enable verbose authentication logging on Jetty and forward events to a centralized SIEM for anomaly analysis.
- Alert on rapid sequential authentication attempts from a single source targeting multiple user accounts.
- Track outbound requests from the Jetty host after successful authentications to detect post-access lateral movement.
How to Mitigate CVE-2026-10050
Immediate Actions Required
- Upgrade Eclipse Jetty to the patched release identified in the GitHub Security Advisory GHSA-2fvj-hgj9-j2gr.
- Force password resets for any account whose current password contains non-ISO-8859-1 characters.
- Rotate credentials for administrative and service accounts that authenticate through Digest.
Patch Information
The Eclipse Jetty project has issued a security advisory tracking the fix. Refer to the GitHub Security Advisory and the Eclipse GitLab CVE Assignment for fixed version numbers and upgrade guidance. Patched releases align Digest authentication with RFC-7616 semantics using UTF-8 encoding.
Workarounds
- Disable Digest authentication and switch to a stronger scheme such as Basic authentication over TLS, mutual TLS, or token-based authentication.
- Enforce a password policy that restricts passwords to the ISO-8859-1 character set until patching completes, eliminating exploitable substitution.
- Place Jetty behind a reverse proxy or WAF that terminates authentication before requests reach the vulnerable Digest handler.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
