CVE-2026-100834 – Digest Authentication Replay Bypass – http4k http4k-security-digest before 6.48.0.

Summary

CVE-2026-100834 is an authentication bypass by capture-replay (CWE-294) affecting the Digest authentication module of the http4k HTTP toolkit for Kotlin (org.http4k:http4k-security-digest). The ServerFilters.DigestAuth and DigestAuthProvider components ship with a default nonceVerifier that accepts every nonce unconditionally, meaning applications relying on the default configuration have no protection against replayed Digest authentication credentials. The issue has existed since DigestAuthProvider was introduced in 2021 and is rated High severity.

Technical details

• Root cause: ServerFilters.DigestAuth and DigestAuthProvider default the nonceVerifier parameter to a function that always returns true ({ true }), so nonce values are never validated for freshness, uniqueness, or prior use.
• Trigger conditions: An application must be using http4k-security-digest for Digest authentication and must not have supplied a custom, stateful nonceVerifier implementation — i.e., it relies on the library’s insecure default.
• Attack vector: Network-based; an attacker must first obtain a valid Authorization: Digest response, for example by observing network traffic (e.g., unencrypted or improperly protected traffic) or by reading logs where the header value was captured.
• Impact: Because nonces are never invalidated, a captured Digest authentication response can be replayed indefinitely against the same protected resource, allowing an attacker to impersonate the legitimate user and gain unauthorized access without ever knowing the underlying password. The primary impact is a loss of confidentiality on the protected resource; there is no direct integrity or availability impact from this flaw alone.

Affected software

• org.http4k:http4k-security-digest versions before 6.48.0.0 (6.x line)
• org.http4k:http4k-security-digest versions before 5.42.0.0 (5.x Enterprise LTS line)
• org.http4k:http4k-security-digest versions before 4.51.0.0 (4.x Enterprise LTS line)

Severity

• CVSS v3.1 Base Score: 5.9 (Medium) — Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4.0 Base Score: 8.2 (High) — Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate: Upgrade http4k-security-digest to version 6.48.0.0 or later (community line), or 5.42.0.0 / 4.51.0.0 or later (Enterprise LTS lines), all of which remove the insecure default and require an explicit nonce verification strategy.
• If immediate patching is not possible: Explicitly configure a custom nonceVerifier on ServerFilters.DigestAuth / DigestAuthProvider that tracks issued nonces, enforces expiration/time limits, and rejects reuse, rather than relying on the library default.
• Additional hardening: Ensure all traffic carrying Digest Authorization headers is transmitted over TLS, and avoid logging raw Authorization header values, to reduce the risk of an attacker capturing replayable credentials in the first place.

References

• GitHub Security Advisory (GHSA-c7jm-38gq-h67h)
• http4k Patch Commit
• VulnCheck Advisory: http4k Digest Authentication Replay Protection Bypass