GHSA-r7p8-xq5m-436c

Description

### Description (as reported) A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`. The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation. See also attached PDF. ### Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation). ### Patches No patches yet. ### Workarounds Do not use Jetty's JASPI.