CVE-2026-54148

http4k (a Kotlin HTTP toolkit) is vulnerable in the http4k-security-digest module. The DigestAuthProvider.verify method did not compare the uri parameter in an Authorization: Digest response with the actual request URL, meaning a captured valid Digest authentication response could be replayed aga...