CVE-2026-10050

Executive Summary

CVE-2026-10050 is an authentication bypass vulnerability in the Eclipse Jetty HTTP server's Digest authentication implementation. Due to the server-side component encoding passwords using the ISO-8859-1 character set, passwords containing non-ISO-8859-1 characters (e.g., Chinese, Cyrillic, Greek) are silently converted to ? characters. An attacker can craft a malicious Digest Authorization header containing only ? characters, causing the server to accept any password of the same length that contains non-ISO-8859-1 characters. This flaw affects all Jetty deployments using Digest authentication with non-ASCII passwords, potentially allowing unauthorized access to protected resources.

Technical Analysis

The vulnerability stems from the historical implementation of the Digest authentication mechanism in Eclipse Jetty. According to the original HTTP specifications, which predated modern charsets, the default character encoding was assumed to be ISO-8859-1. Jetty's server-side Digest authentication component adheres to this legacy behavior, encoding the stored password as bytes using ISO-8859-1.

When a password contains characters not representable in ISO-8859-1 — such as the Greek characters in αβ123 — the encoding process silently replaces them with ASCII ? characters. Thus, αβ123 becomes ??123 in the encoded form.

The attack logic is as follows:

1. The attacker targets a web application protected by Digest authentication that uses non-ASCII passwords.
2. The attacker calculates a Digest response using the HA1 algorithm (MD5(username:realm:password)), but substitutes all non-ASCII password characters with ?.
3. Upon receipt, Jetty encodes both the stored password and the attacker-supplied password using ISO-8859-1. Since both encode identically (both containing ?), the MD5 hashes match.
4. Authentication is granted.

This effectively means that for any password containing non-ISO-8859-1 characters, the attacker can guess it by simply using a string of ? characters of equal length. The complexity of the password (length, digits, special characters) is irrelevant, as only the number of non-ASCII characters matters for the bypass.

RFC-7616, the modern HTTP Digest specification, supports a charset parameter that defaults to UTF-8, which correctly handles Unicode passwords. However, Jetty's implementation does not appear to comply with this part of the specification, creating a mismatch between standards compliance and security.

The attack surface is any web application or service that relies on Jetty's built-in Digest authentication with non-ASCII passwords. This is particularly impactful in internationalized environments, where passwords in local languages (Chinese, Korean, Cyrillic, Greek, Arabic, etc.) are common.

Exploitation Scenarios

Scenario: Bypassing Digest Authentication on an Internet-Facing Service

1. Reconnaissance: The attacker identifies a target using Jetty as its web server (e.g., via response headers Server: Jetty(version) or Shodan searches). The attacker enumerates protected endpoints that require authentication, likely finding a login form or a 401 challenge response.

2. Trigger/Weaponization: The attacker sends an unauthenticated request to a protected resource. The server responds with a 401 Unauthorized and a WWW-Authenticate: Digest header containing a nonce and realm. The attacker collects this challenge data. Next, the attacker creates a new Digest Authorization header. The key step: the attacker sets the password field (as used in the HA1 calculation) to a string of ? characters. The attacker must estimate the password length. This can be done iteratively — starting with 1 ?, then 2, 4, 8, etc., until authentication succeeds. Each attempt triggers a fresh nonce challenge, but the attacker can pre-calculate multiple hashes for different lengths.

3. Payload Execution: The attacker crafts the Authorization header:

   GET /admin HTTP/1.1
   Host: target.com
   Authorization: Digest username="admin", realm="MyRealm", nonce="server_nonce", uri="/admin", response="calculated_ha1_md5", qop=auth, nc=00000001, cnonce="attacker_cnonce"
   

   The response value is computed as MD5(HA1:nonce:nc:cnonce:qop:MD5(method:uri)), where HA1 itself is MD5(username:realm:password). The attacker substitutes password with a string of ? characters in the HA1 computation.

4. Post-Exploitation: Once the attacker successfully authenticates, they gain the same access privileges as the legitimate user. If the compromised account is an administrator, the attacker can modify server configurations, access sensitive data, steal credentials, pivot to internal networks, or deploy malware.

Verification Steps for Penetration Testers:

1. Intercept a legitimate Digest auth exchange to obtain the realm and nonce.
2. Create a test password of only ? characters in your Digest calculation tools (e.g., cURL with --digest -u username:?).
3. Iterate the number of ? characters until the server returns a 200 OK instead of 401.
4. If successful, the system is vulnerable.

Impact Assessment

Business Impact: High. The vulnerability allows authentication bypass, compromising the confidentiality and integrity of protected resources. This could lead to data exfiltration, unauthorized system modification, and reputational damage.

Affected Systems: All Eclipse Jetty deployments (versions 9.x, 10.x, 11.x) that:

• Use Digest authentication (<Set name="authentication"><Auth id="..." method="DIGEST"/></Set> or equivalent configuration).
• Have user accounts with passwords containing characters outside the ISO-8859-1 character set.

Blast Radius:

• Confidentiality Impact: High (CVSS subscore). The attacker gains unauthorized access to sensitive information behind authentication.
• Integrity Impact: High (if the compromised account has write access). The attacker can alter data or system configurations.
• Availability Impact: Low (the attacker is unlikely to cause a denial of service directly).

CVSS v3.1 Score: N/A (not officially assigned). Based on analysis, an estimated vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N — the high attack complexity reflects that only passwords with non-ASCII characters are affected, requiring the attacker to identify such accounts.

Detection Guidance

Sigma Rule

title: Jetty Digest Authentication Bypass Attempt (CVE-2026-10050)
id: 7f9c2d4e-8a3b-4c5d-9e6f-0a1b2c3d4e5f
status: experimental
description: Detects repeated Digest authentication failures followed by successful access with suspicious '?' password patterns.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10050
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: web_server
    product: jetty
detection:
    selection_auth_challenge:
        cs-method: GET
        cs-uri-query|contains: 
            - 'Authorization: Digest'
            - 'response='
    selection_failed_attempts:
        sc-status: 401
        timeframe: 5m
        count: 5
    selection_success:
        sc-status: 200
        cs-user-agent: '*'
    condition: selection_failed_attempts and selection_success
    timeframe: 10m
level: high
falsepositives:
    - Legitimate users who mistype passwords
    - Automated monitoring tools

YARA Rule

rule Jetty_Digest_Auth_Bypass_CVE_2026_10050
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP response headers indicating Jetty server version potentially vulnerable to CVE-2026-10050"
        date = "2026-02-14"
        reference = "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10050"
    strings:
        $server_header = /(?i)Server:\s*Jetty\((\d+\.\d+\.\d+)/ 
        $digest_challenge = /(?i)WWW-Authenticate:\s*Digest\s*realm=/ 
        $cve_string = "CVE-2026-10050"
    condition:
        $server_header and $digest_challenge
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Jetty Digest Auth Password '?' Bypass Attempt (CVE-2026-10050)"; flow:to_server,established; content:"Authorization: Digest"; http_header; content:"response="; http_header; nocase; pcre:"/response=\"[a-fA-F0-9]{32}\"/"; pcre:"/username=\"[^"]+\".*realm=\"[^"]+\"/"; pcre:"/qop=|nc=/"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026100501; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where destination.port == 80 and http.request.method == "GET" and 
    http.request.headers.authorization contains "Digest" and http.response.status_code == 401 ]
  [ network where destination.port == 80 and http.request.method == "GET" and 
    http.response.status_code == 200 and http.request.headers.authorization contains "Digest" ]

Splunk SPL Query

index=web sourcetype=access_combined_w3c
| where like(status, "401") AND like(uri, "*")
| stats count as failed_count by clientip, uri
| where failed_count > 5
| join type=inner clientip, uri [search index=web status=200 
    | stats count as success_count by clientip, uri
    | where success_count > 0]
| table _time, clientip, uri, failed_count, success_count
| eval signature="Potential CVE-2026-10050 Digest Auth Bypass"

Wazuh OSSEC Rule

<group name="jetty,">
  <rule id="100501" level="12">
    <decoded>Jetty Digest Authentication</decoded>
    <match>WWW-Authenticate: Digest</match>
    <description>Jetty Digest Auth bypass attempt detected (CVE-2026-10050)</description>
    <group>authentication_failure,attack,t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Vendor Fix is N/A.

Immediate Mitigations (Implement in order of priority):

1. Disable Digest Authentication: If possible, switch to another authentication mechanism such as Basic over TLS (HTTPS) or Form-based authentication with a secure password hashing algorithm (e.g., bcrypt, PBKDF2).
2. Audit Existing Passwords: Identify all user accounts using Digest authentication and force a password reset. Require all new passwords to contain only ASCII characters (falling under the ISO-8859-1 range) until the patch is released.
3. Network Restriction: Limit access to Digest-authenticated endpoints to trusted IP ranges or VPN connections to reduce the attack surface.

Patch/Upgrade Steps:

1. Monitor the Eclipse Jetty security advisory page (https://eclipse.dev/jetty/security/) for an official patch.
2. When a patched version is released, upgrade all affected Jetty instances immediately. The patch will likely update the Digest authentication component to use UTF-8 encoding as per RFC-7616.
3. Test the patched versions thoroughly against existing applications, particularly internationalized deployments.

Long-Term Hardening:

1. Adopt RFC-7616 Compliance: When upgrading, configure Jetty to use the charset=utf-8 parameter in Digest authentication. Ensure both client and server support this parameter.
2. Use Strong Authentication Protocols: Prefer modern authentication methods like OAuth 2.0, OpenID Connect, or mutual TLS over legacy Digest authentication.
3. Implement Application-Level Password Policies: Enforce password complexity that meets or exceeds NIST SP 800-63B guidelines, including requiring a mix of character sets but being cautious with non-ASCII characters until full Unicode support is verified.
4. Regular Security Reviews: Include this CVE in vulnerability management dashboards and track it until a patch is confirmed and deployed.

References

1. NVD Entry for CVE-2026-10050 — https://nvd.nist.gov/vuln/detail/CVE-2026-10050
2. RFC 7616 - HTTP Digest Access Authentication — https://datatracker.ietf.org/doc/html/rfc7616
3. Eclipse Jetty Security Advisories — https://eclipse.dev/jetty/security/
4. CWE-173: Improper Handling of Alternate Encoding — https://cwe.mitre.org/data/definitions/173.html
5. CISA Known Exploited Vulnerabilities Catalog (no listing for CVE-2026-10050) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns targeting this vulnerability have been observed in the wild as of this report's publication. The lack of public exploit code and a patch increases the potential for targeted attacks, particularly in environments where internationalized passwords are used. Security teams are advised to treat this vulnerability with high severity and prioritize the mitigations listed above.