http4k-security-digest CVE-2026-54148
HIGH
GHSA-p28p-j94q-pg32
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Capturing a Digest credential in transit requires a network interception position, warranting AC:H; PR:N because the attacker presents a stolen victim credential, not their own.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
An issue in DigestAuthProvider.verify:
The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes.
Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).
Patches
| Line | Fixed in | Edition |
|---|---|---|
| v6.x (Community) | 6.50.0.0 | Community |
| v5.x (LTS) | 5.42.0.0 | Enterprise - contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v5.x line) |
| v4.x (LTS) | 4.51.0.0 | Enterprise - contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v4.x line) |
The fix:
- Rejects credentials whose
uriparameter does not match the request URL.
Workarounds
For deployments that cannot upgrade immediately:
- URI binding gap: place Digest auth behind a reverse proxy that pins requests to a single URL.
References
- Vulnerability first present:
8a52b615b1 - URI binding fix:
725f1b9697 - Fix release: v6.50.0.0
- Background: RFC 7616 - HTTP Digest Access Authentication
AnalysisAI
Digest authentication credential replay in http4k-security-digest exposes all URLs within an authentication realm to unauthorized access when an attacker can obtain any valid Digest credential for that realm. The library's DigestAuthProvider.verify method never passed the actual request URI into its validation logic, meaning the uri field in a client's Authorization: Digest header was never compared against the URL actually being requested - a direct violation of the per-request binding mandated by RFC 7616. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses `org.http4k:http4k-security-digest` for HTTP Digest authentication and that the attacker can obtain a valid, unexpired Digest credential for any URL in the targeted realm. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) rates this as high severity, driven by high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 6.50.0.0 (Community v6.x) and 5.42.0.0 (Enterprise v5.x LTS). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using http4k-security-digest through dependency scanning and classify by data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today