Critical bypass flaw in Eclipse EthereumAuthenticator allows unauthenticated access
A CVSS 9.3 vulnerability in Eclipse EthereumAuthenticator permits unauthorized access if request paths contain the login URL.
Key points
- CVE-2026-19863 is rated critical with a CVSS score of 9.3.
- The flaw stems from an unanchored substring match in path validation.
- Eclipse Foundation components up to version 12.1.12 are affected.
The Eclipse Foundation has identified a critical authentication bypass vulnerability in its EthereumAuthenticator component. The flaw, tracked as CVE-2026-19863, allows unauthenticated clients to access protected resources under specific path conditions.
At a glance
- CVE
- CVE-2026-19863
- Product
- Eclipse Foundation
- CVSS
- 9.3 Critical
- Weakness
- authentication bypass
- Exploited
- No known exploitation
According to the National Vulnerability Database, the issue carries a CVSS score of 9.3, placing it in the critical severity range. The weakness is associated with CWE-288 and CWE-863. Attackers can exploit this defect to bypass security controls without valid credentials.
Technical details of the bypass
The vulnerability arises because the authenticator uses an unanchored substring match to identify the login page. This logic error causes the system to misinterpret certain protected request paths as the legitimate login endpoint. When the configured login path appears later within a protected request path, the system treats the request as the login page.
Consequently, the authentication or role requirements for that request are replaced with an ALLOWED status. This effectively grants the unauthenticated client access to resources that should remain protected. The NVD record specifies that this behavior occurs only when the login path is a later segment of the URL.
Scope and affected versions
This issue affects software provided by the Eclipse Foundation. Specifically, versions of EthereumAuthenticator up to and including 12.1.12 are vulnerable. Organizations using these versions should verify their deployment status immediately.
The National Vulnerability Database notes that explicitly FORBIDDEN routes are not affected by this flaw. This distinction limits the scope of accessible resources, but the risk remains significant for any protected path that inadvertently includes the login path string.
What should you do?
Security teams should audit their EthereumAuthenticator configurations to determine if they are running vulnerable versions. Reviewing access logs for unusual unauthenticated requests to paths containing login strings may reveal exploitation attempts.
What to do and how to stay safe: CVE-2026-19863
- Inventory all instances of EthereumAuthenticator to confirm if versions 12.1.12 or earlier are in use.
- Review server logs for unauthenticated requests that contain the configured login path within longer URLs.
- Ensure that protected resource paths do not include the login path string as a substring to mitigate risk.
- Monitor for official updates from the Eclipse Foundation regarding a patched version of the component.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-19863?
It is a critical authentication bypass vulnerability in Eclipse EthereumAuthenticator that allows unauthenticated access to protected resources.
Which versions are affected?
Eclipse Foundation versions of EthereumAuthenticator up to 12.1.12 are affected by this flaw.
How is the vulnerability exploited?
Exploitation requires a protected resource path to contain the configured login path as a later segment, causing the system to allow access.
