AsyncHttpClient EUVD-2026-94636

Requires (1) the application to use AsyncHttpClient prior to 3.0.13 (3.x) or 2.16.1 (2.x) with HTTP credentials configured via Realm.Builder, and (2) the client to send an authenticated request to an origin server or proxy that the attacker controls, has compromised, or can tamper with in transit. The attacker must return a WWW-Authenticate or Proxy-Authenticate header labeled 'Digest' while omitting or emptying the nonce parameter, which triggers the downgrade to Basic. Limiting factors: no effect on applications that do not configure credentials; the attacker must be able to supply or modify the authentication challenge (malicious/compromised endpoint or an active network MITM position), so it is not exploitable against arbitrary clients without that server/proxy control.

This is a credential-disclosure flaw (CWE-319) in the AsyncHttpClient Java library where a Digest WWW-Authenticate/Proxy-Authenticate challenge with an omitted or empty nonce is silently downgraded to Basic, causing the client to resend the configured username and password using reversible Base64 encoding. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7 (High) and is internally consistent with the mechanism: confidentiality-only impact (VC:H, VI:N, VA:N), no attacker privileges, and no user interaction. However, the CVSS 'network, no-privileges' framing understates a real precondition - exploitation requires the victim application to (a) be configured with credentials in Realm.Builder and (b) direct an authenticated request to an origin or proxy the attacker controls or can tamper with in transit. This is effectively a malicious-server / MITM capability rather than a drive-by remote exploit, so the practical attacker position is more demanding than PR:N alone suggests. No EPSS score, CISA KEV listing, or POC was provided in the input; per precision rules, there is no public exploit identified at time of analysis. The source-code diff and fixed-release tags confirm the root cause and remediation, so this is a legitimate, well-substantiated issue to patch, but absent active-exploitation signals it should be prioritized as a dependency hygiene / supply-chain credential-hardening fix rather than an emergency.

A Java application built on AsyncHttpClient is configured with HTTP credentials and makes an authenticated request to an endpoint (or through a proxy) that an attacker controls or can intercept. The attacker returns a challenge labeled 'Digest' but with no usable nonce; the client downgrades to Basic and transmits the username and password Base64-encoded, which the attacker trivially decodes to cleartext. No public exploit code was identified in the provided data, but the technique is simple to reproduce for anyone controlling the response headers.