Eclipse Jetty's SessionAuthentication serializes authentication credentials in a session object. When a user logs in with a plaintext password, the password is stored unchanged inside that object. Persisting the session to the server's session data store results in the plaintext password being written to disk, exposing it to anyone who can read the store. This flaw directly leads to credential disclosure, compromising accounts that rely on those passwords.

The vulnerability is present in the Eclipse Jetty server, specifically the SessionAuthentication component. No particular Jetty version is explicitly listed; therefore all versions that implement the described serialization mechanism are potentially affected. Administrators should assess the Jetty version they are running against the Jetty project advisories for confirmation.

The CVSS score of 5.6 indicates a moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. Because the flaw requires the attacker to have read access to the session persistence store, it is not a remote vulnerability but still critical if privileged insiders or compromised services can read the data. The vulnerability is not listed in CISA's KEV catalog, but organizations that deploy Jetty in production should still consider patching promptly.