When Jetty’s HttpClient routes an outgoing request through a forward proxy, a 407 Proxy Authentication Required response can be returned by the target server. The client incorrectly interprets the 407 as coming from the proxy and resends the request with a Proxy-Authentication header. The header then arrives at the target server, which now has visibility into the proxy credentials. This unintended disclosure of authentication data constitutes an information‑disclosure vulnerability.

The flaw affects the Eclipse Jetty HTTP client library in any Jetty deployment that performs proxy authentication for outbound requests. No specific product versions are listed, so all releases of Jetty that include the HttpClient component may be susceptible.

The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1 percent reflects a very low likelihood of exploitation at this time, and the vulnerability is not yet included in CISA’s KEV catalog. The attack can be carried out remotely by any actor who controls or can observe the target server that receives the misdirected credentials; the client’s logic flaw makes the exploitation straightforward if the attack surface exists.