The flaw occurs in Eclipse Jetty’s JASPIAuthenticator class, where thread-local variables used for authentication checks are not cleared when an early return happens. As a result, a subsequent request handled by the same thread inherits stale authentication data, effectively bypassing access controls and allowing an attacker to execute actions with elevated privileges. This represents an authentication bypass and broken access control weakness.

Any installation of the Eclipse Jetty web server that includes the JASPIAuthenticator component is potentially vulnerable. Specific product and version details are not listed in the advisory, so all supported Jetty releases should be verified for the presence of the issue.

The advisory assigns a CVSS base score of 7.4, indicating a high impact vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as remote, relying on HTTP requests sent to the server; an attacker must be able to send multiple requests that are processed on the same worker thread to exploit the thread‑local residue.