CVE-2026-100834
Full vulnerability record from the local CVENow database.
Description
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.
Severity
HIGH
CVSS score
8.2
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-09-27 02:17:21.487000
Last modified
2026-10-29 21:17:07.120000
View original CVE JSON
{
"id": "CVE-2026-100834",
"sourceIdentifier": "[email protected]",
"published": "2026-09-27T02:17:21.487",
"lastModified": "2026-10-29T21:17:07.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "http4k",
"product": "http4k",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.http4k/http4k-security-digest",
"versions": [
{
"version": "6.0.0.0",
"lessThan": "6.48.0.0",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.48.0.0",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "http4k",
"product": "http4k",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.http4k/http4k-security-digest",
"versions": [
{
"version": "5.0.0.0",
"lessThan": "5.42.0.0",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.42.0.0",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "http4k",
"product": "http4k",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.http4k/http4k-security-digest",
"versions": [
{
"version": "0",
"lessThan": "4.51.0.0",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.51.0.0",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-09-30T17:03:50.406355Z",
"id": "CVE-2026-100834",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-294"
}
]
}
],
"references": [
{
"url": "https://github.com/http4k/http4k/commit/4f904b4692",
"source": "[email protected]"
},
{
"url": "https://github.com/http4k/http4k/commit/8a52b615b1",
"source": "[email protected]"
},
{
"url": "https://github.com/http4k/http4k/security/advisories/GHSA-c7jm-38gq-h67h",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-digest-authentication-replay-protection-bypass",
"source": "[email protected]"
}
]
}