CVE-2026-18659 Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
Attackers can bypass authentication constraints in Jetty by using substrings of HTTP methods, allowing unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18659?
CVE-2026-18659 is a medium-severity authentication bypass vulnerability, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
Weakness: CWE-863
Which versions are affected by CVE-2026-18659?
How do I fix CVE-2026-18659?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18659 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18659 exists.
Sources
Also known as DEBIAN-CVE-2026-18659, GHSA-53x7-f9fc-h7qr, UBUNTU-CVE-2026-18659.