GHSA-P28P-J94Q-PG32 http4k: `DigestAuthProvider.verify` did not bind to request URI

Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...

GHSA-VXXM-WWQH-MH47 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

PT-2026-53777

Impact ServerFilters.DigestAuth and the underlying DigestAuthProvider both defaulted their nonceVerifier parameter to true — i.e. every nonce was accepted regardless of value, age, or prior use. Any deployment using the default configuration had no replay protection on Digest authentication; a...