http4k-security-digest CVE-2026-54147
MEDIUM
GHSA-vxxm-wwqh-mh47
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Network vector applies to Digest auth protocol; AC:H reflects non-trivial MD5 collision exploitation requirement; I:H for authentication bypass enabling impersonation; no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
An issue in DigestAuthProvider.verify:
Algorithm silently forced to MD5. The configured algorithm parameter was ignored - every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses, including documented attack paths against Digest schemes that rely on the hash being collision-resistant.
Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).
Patches
| Line | Fixed in | Edition |
|---|---|---|
| v6.x (Community) | 6.50.0.0 | Community |
| v5.x (LTS) | 5.42.0.0 | Enterprise - contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v5.x line) |
| v4.x (LTS) | 4.51.0.0 | Enterprise - contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v4.x line) |
The fix:
- Hashes with the configured
algorithminstead of hardcoded MD5.
Workarounds
For deployments that cannot upgrade immediately:
- Algorithm gap: do not rely on
algorithmconfiguration; assume MD5 is in use and treat the Digest credentials as low-trust.
References
- Vulnerability first present:
8a52b615b1 - Algorithm fix:
65d23d99fc - Fix release: v6.50.0.0
- Background: RFC 7616 - HTTP Digest Access Authentication
AnalysisAI
HTTP Digest authentication in http4k-security-digest silently degraded to MD5 for all credential verification, regardless of the configured algorithm. Applications on any v4.x, v5.x, or v6.x release prior to the fixes believed they were enforcing SHA-256 Digest auth but were actually operating under MD5's weaker collision resistance since the component's introduction in 2021. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target application uses http4k-security-digest's DigestAuthProvider for HTTP Digest authentication; (2) the server was configured with a non-MD5 algorithm (such as SHA-256) under the assumption it would be enforced - deployments explicitly using MD5 receive no additional weakening from this bug; and (3) the attacker has the capability to conduct MD5 collision or chosen-prefix attacks against the Digest scheme, which typically requires a man-in-the-middle network position or significant offline pre-computation resources. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 6.5 Medium vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) is broadly consistent with the vulnerability's nature. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to http4k-security-digest v6.50.0.0 (Community edition), available at https://github.com/http4k/http4k/releases/tag/6.50.0.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today