Apache HTTP Server EUVD-2026-90892

Exploitable ONLY when the server is configured for Digest authentication (mod_auth_digest) AND the AuthDigestNcCheck directive is enabled - this is a non-default, relatively uncommon configuration, which is the primary factor limiting real-world exposure. When that configuration is present, an unauthenticated remote client can trigger the flaw by sending forged Authorization headers; no user interaction and no valid credentials are required. The impact is limited to forced re-authentication (denial of service) against the affected protected resources, not compromise of confidentiality or integrity. Servers not using Digest auth, or using it without AuthDigestNcCheck, are not affected.

This is a limited-impact availability flaw being over-weighted by product ubiquity. No CVSS score or vector is provided in the input, EPSS is absent, the CVE is not listed in CISA KEV, and no public exploit is identified - so there is no signal of active or probable exploitation. The technical impact is confined to a denial of service in the form of forced re-authentication (not code execution, not data disclosure, no authentication bypass of protected resources despite the 'Authentication Bypass' tag), and it only manifests when Digest authentication is configured with AuthDigestNcCheck, a non-default and uncommon deployment. CWE-306 (Missing Authentication) and the description indicate an unauthenticated remote trigger, which raises reachability, but the worst-case outcome is nuisance-level service disruption against the specific auth-protected endpoints. Net: despite Apache HTTP Server's enormous footprint, the narrow and uncommon configuration prerequisite plus DoS-only impact make this a low-to-moderate real-world priority rather than an urgent one. Note the absence of a vendor/NVD CVSS vector means attack complexity and precise impact are inferred from the description, not confirmed.

An attacker sends HTTP requests with forged Authorization headers to an Apache server that has Digest authentication enabled with AuthDigestNcCheck, causing the server to force re-authentication and disrupting legitimate authenticated sessions. No public exploit code has been identified, and exploitation is only possible against this specific non-default authentication configuration.