An unauthenticated client can access protected resources managed by Jetty's EthereumAuthenticator when the request path contains the configured login path. The authenticator performs an unanchored substring match, so if the login token appears later in a protected URL, the request is mistakenly treated as the login page and its authentication requirement is replaced with ALLOWED, resulting in an authorization bypass. The flaw does not provide remote code execution but allows attackers to read or manipulate data protected by role or authentication checks.

This issue affects installations of Jetty that use the EthereumAuthenticator component. The exact product versions are not enumerated in the advisory, so any Jetty deployment that includes this authenticator and has login paths that could appear as subsegments in protected URLs is potentially vulnerable. Administrators should verify if the Jetty project is used and if the EthereumAuthenticator is enabled.

The CVSS score of 9.3 reflects the severe impact of an unauthorized request bypass. However, the EPSS score of less than 1% indicates the current likelihood of exploitation is very low. The vulnerability is not listed in CISA's KEV catalog, meaning no publicly disclosed exploits are known. The attack requires that a protected resource path contain the login path as a later segment, and explicitly forbidden routes are not affected. Exposing this path allows an unauthenticated client to trigger the bypass and access protected resources without authentication.