http4k prior 6.48.0.0/5.42.0.0/4.51.0.0 Digest Authentication ServerFilters.DigestAuth nonceVerifier authentication replay

Summaryinfo

A vulnerability classified as critical was found in http4k. This impacts the function ServerFilters.DigestAuth of the component Digest Authentication. The manipulation of the argument nonceVerifier results in authentication replay. This vulnerability is known as CVE-2026-100834. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in http4k. Affected is the function ServerFilters.DigestAuth of the component Digest Authentication. The manipulation of the argument nonceVerifier with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-100834 since 09/27/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1040.

Upgrading to version 6.48.0.0, 5.42.0.0 or 4.51.0.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• http4k

Website

• Product: https://github.com/http4k/http4k/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion