Apache HTTP Server EUVD-2026-90907

Exploitation requires ALL of the following: the server must run Apache HTTP Server 2.4.x with mod_auth_digest enabled for authentication; the directive AuthDigestNonceLifetime must be explicitly set to 0 (a non-default configuration); and the attacker must hold a man-in-the-middle position to capture the victim's digest authentication credentials. The attack further depends on sending crafted requests that force garbage collection of the client's shared-memory nonce entry so the captured credentials can be replayed. Limiting factors: the MITM prerequisite means the attacker cannot exploit this purely remotely without network interception (e.g., unencrypted HTTP or a compromised path), and the AuthDigestNonceLifetime=0 setting is not a default, substantially narrowing the exposed population.

No CVSS vector was provided by the source (CVSS: N/A), so severity signals must be inferred from the description and CWE-294 (Authentication Bypass by Capture-replay). This is NOT confirmed actively exploited: it is absent from CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not supplied and cannot be assumed. The real-world risk is tightly bounded by several stacked prerequisites rather than being a broad network-exploitable flaw: the attacker must (1) occupy a man-in-the-middle position on the traffic path, (2) target a server using mod_auth_digest for authentication, and (3) rely on the non-default configuration AuthDigestNonceLifetime=0. While Apache HTTP Server itself is ubiquitous, the specific vulnerable configuration (digest auth with nonce lifetime of 0) is uncommon in modern deployments, which favor TLS-terminated form/token auth over HTTP digest. Net assessment: this is a legitimate authentication-bypass weakness in a ubiquitous product, but the MITM requirement plus non-default configuration make it a lower-priority, conditional issue rather than a mass-exploitation threat - patch as part of normal maintenance unless digest auth with the vulnerable setting is in use, in which case prioritize. No CVSS score is available to independently corroborate this, so severity should be validated against the vendor advisory.

An attacker positioned as a man-in-the-middle on the network path between a client and an Apache 2.4.x server (configured with mod_auth_digest and AuthDigestNonceLifetime=0) captures a client's digest authentication credentials. The attacker then sends crafted requests that trigger garbage collection of the client's shared-memory nonce entry, allowing the previously captured credentials to be replayed successfully and bypass authentication. No public exploit code is referenced for this CVE.