Weak Authentication

org.eclipse.jetty, jetty-openid is vulnerable to Weak Authentication. The vulnerability is caused by a logical programming defect in the validateRequest function in the OpenIdAuthenticator.java class which allows current requests to still proceed even when LoginService does return that the authentication has been revoked (from the validate() method) and the OpenIdAuthenticator removes the authentication from the session. This results in the current request still being treated as authenticated and can cause a request on a previously authenticated session to be allowed to bypass authentication after it had been rejected by the LoginService. This vulnerability is possible only when Jetty OpenIdAuthenticator uses the optional LoginService.