The flaw causes Jetty to encode passwords using ISO-8859-1, silently replacing unsupported characters with ‘?’; an attacker can craft a Digest Authorization header with a password consisting only of ‘?’ characters, and the server will match it against any non‑ISO‑8859‑1 password of the same length. This allows remote authentication as any user whose password contains non‑ASCII characters, representing an authentication bypass vulnerability. The weakness falls under the Critical Security Weaknesses CWE‑173 (Lossy Encoding) and CWE‑303 (Improper Authentication).

The Eclipse Foundation’s Jetty web server, including the standard Jetty distribution, Jetty EE8, and Jetty EE9 are affected. No specific version numbers are given, so any instance running these products should be assumed vulnerable until a patch is applied.

With a CVSS score of 8.7 this vulnerability is considered high severity. No EPSS score is available and it is not listed in CISA’s KEV catalog, yet the simplicity of the attack path means it can be executed remotely from any client capable of sending a HTTP Digest Authorization request. The attacker only needs the target username and can then authenticate by sending the specially crafted header.