Eclipse Jetty JASPIAuthenticator ThreadLocal Variable Inheritance Vulnerability Leading to Privilege Escalation

A vulnerability in Eclipse Jetty's JASPIAuthenticator class allows for broken access control and privilege escalation. The issue arises because the authentication process sets two ThreadLocal variables, which are not cleared before the method returns. As a result, these ThreadLocal values can be inherited by subsequent requests using the same thread, leading to unauthorized access or privileges.

Impact

Exploitation of this vulnerability could result in unauthorized access or privileges being granted to a user.