In Eclipse Jetty, when multiple security constraints are defined with identical http-method-omission sets and without url-patterns, the Jetty security module does not combine them correctly. The constraint defined later overrides earlier ones, allowing requests that should be denied to be granted access. This failure in implementing access control policies means an attacker could exploit the server to reach protected endpoints without proper authentication or authorization. The weakness is classified as CWE‑425 and CWE‑863, both relating to improper handling of access control and resource restrictions.

The vulnerability affects the Jetty web server, specifically the jetty-security and jetty-eeN-security components. All versions containing the described behavior are impacted, although no exact version range is provided in the CVE data. Organizations using any of these modules should verify the Jetty version in use and consult Jetty release notes for fixes.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog, so it is not known to be actively exploited. The likely attack vector is remote, requiring an attacker to send specially crafted HTTP requests to the vulnerable Jetty instance. Successful exploitation would allow unauthorized access to protected resources, potentially compromising confidentiality and integrity of the data served by the application.