CVE-2026-100834

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834

The http4k library's Digest authentication module (org.http4k:http4k-security-digest ) is vulnerable in versions before 6.48.0.0 , 5.42.0.0 , and 4.51.0.0 . The root cause is that the nonceVerifier parameter in ServerFilters.DigestAuth and DigestAuthProvider defaults to { true }, meaning every no...

CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834: Authentication Bypass by Capture-replay

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-54148 http4k: `DigestAuthProvider.verify` did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

CVE-2026-54148: Authentication Bypass by Capture-replay

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

CVE-2026-54147: Use of a Broken or Risky Cryptographic Algorithm

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

URI Validation Bypass

http4k-security-digest is vulnerable to URI Validation Bypass. The vulnerability is due to the client not validating the uri parameter in the Digest authentication response against the actual request URL, which allows an attacker to replay a captured authentication response against other URLs...

GHSA-P28P-J94Q-PG32 http4k: `DigestAuthProvider.verify` did not bind to request URI

Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...

PT-2026-76891

Name of the Vulnerable Software and Affected Versions http4k versions prior to 4.51.0.0 http4k versions prior to 5.42.0.0 http4k versions prior to 6.50.0.0 Description In the http4k-security-digest module, the DigestAuthProvider.verify function ignores the configured algorithm parameter and inste...

PT-2026-76892

Name of the Vulnerable Software and Affected Versions http4k versions prior to 4.51.0.0 http4k versions prior to 5.42.0.0 http4k versions prior to 6.50.0.0 Description In the http4k-security-digest module, the DigestAuthProvider.verify function fails to compare the uri parameter within an...