CVE-2026-100834: http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
org.http4k:http4k-security-digestto a version that resolves this vulnerability.Fixed in 6.48.0.0 - Upgrade
Upgrade
org.http4k:http4k-security-digestto a version that resolves this vulnerability.Fixed in 5.42.0.0 - Upgrade
Upgrade
org.http4k:http4k-security-digestto a version that resolves this vulnerability.Fixed in 4.51.0.0
Event History
Frequently Asked Questions
Which applications are exposed to replay attacks?
Applications using org.http4k:http4k-security-digest with ServerFilters.DigestAuth or DigestAuthProvider are exposed if they rely on the default nonceVerifier. The affected defaults apply before versions 6.48.0.0, 5.42.0.0, and 4.51.0.0.
What does an attacker need to exploit this issue?
An attacker needs to capture a valid Authorization: Digest response for the protected resource, such as by observing network traffic or reading logs. No authentication, user interaction, or nonce value validation bypass is otherwise required.
How can we determine whether our deployment is affected?
Review the installed http4k-security-digest version and the DigestAuth or DigestAuthProvider configuration. A deployment is affected when it uses a version before the fixed releases and leaves nonceVerifier at its default value.
What can be done if upgrading is not immediately possible?
Configure DigestAuth or DigestAuthProvider with a nonceVerifier that validates nonce values, age, and prior use rather than accepting every nonce. Also treat captured Digest Authorization values in traffic captures and logs as replayable credentials.