The vulnerability exists in the Eclipse Jetty HttpClient component, where a redirect URL containing path traversal (e.g., "/secure/../evil") is not properly normalized before credential matching. If an attacker can influence the redirect, the client will match authentication credentials against the unnormalized path (/secure) and then send the Authorization header to the target path /evil, effectively leaking credentials for the original authenticated endpoint. This results in sensitive credential disclosure and potential unauthorized access to the attacker‑controlled endpoint.

Eclipse Foundation’s Eclipse Jetty products, specifically jetty-client and jetty-http-tools, are affected. Exact version ranges are not provided in the current data; any deployment using unpatched Jetty components is potentially vulnerable.

The vulnerability has a high CVSS score of 8.2, indicating severe impact if exploited. The EPSS score is reported as < 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control redirects and have an application deployed on the same domain; thus the likelihood is bounded but the potential damage is significant. The attack vector is most likely an application‑controlled redirect over HTTP within the same domain, and the scope covers any client that follows redirects without path normalization.