EUVD-2026-88142

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-82379 Apache Roller: WSSE digest authentication headers can be replayed

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-82379

Apache Roller 6.1.5 is vulnerable to an authentication bypass via a capture-replay attack. The root cause is the failure to enforce nonce uniqueness or timestamp freshness during WSSE digest authentication. An attacker who captures a valid WSSE digest authentication header can replay it to gain t...