CVE-2026-100834

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834

The http4k library's Digest authentication module (org.http4k:http4k-security-digest ) is vulnerable in versions before 6.48.0.0 , 5.42.0.0 , and 4.51.0.0 . The root cause is that the nonceVerifier parameter in ServerFilters.DigestAuth and DigestAuthProvider defaults to { true }, meaning every no...

CVE-2026-100834

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

EUVD-2026-87852

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834: Authentication Bypass by Capture-replay

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

PT-2026-99454

Name of the Vulnerable Software and Affected Versions org.http4k:http4k-security-digest versions prior to 6.48.0.0 org.http4k:http4k-security-digest versions prior to 5.42.0.0 org.http4k:http4k-security-digest versions prior to 4.51.0.0 Description The Digest authentication module defaults the...