CVE-2026-54147: 
Java vulnerability analysis and mitigation

CVE-2026-54147 is a cryptographic bypass vulnerability in the http4k-security-digest library (Maven package org.http4k:http4k-security-digest) where DigestAuthProvider.verify silently forces all digest authentication verification to use MD5, regardless of the configured algorithm. The bug has been present since DigestAuthProvider was introduced in 2021 (commit 8a52b615b1) and affects all v4.x versions through 4.50.0.0, v5.x versions through 5.41.0.0, and v6.x versions through 6.49.0.0. It was first disclosed on June 16, 2026, and published to the GitHub Advisory Database on August 17, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, http4k Advisory).

The root cause is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). In DigestAuthProvider.verify, the DigestEncoder was instantiated with a hardcoded MessageDigest.getInstance("MD5") call instead of using the provider's configured algorithm parameter — a single-line bug (val digestEncoder = DigestEncoder(MessageDigest.getInstance("MD5"))) that was corrected to MessageDigest.getInstance(algorithm) in the fix commit (Fix Commit). As a result, deployments configured to use SHA-256 Digest authentication were silently operating under MD5's weaker collision resistance, exposing them to documented attack paths against Digest authentication schemes that depend on hash collision resistance (per RFC 7616). An unauthenticated network attacker with high attack complexity could exploit MD5 collision weaknesses to forge valid Digest authentication credentials (Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass HTTP Digest authentication controls by forging valid credentials using MD5 collision techniques, even when the application is configured to use a stronger algorithm such as SHA-256. The primary impact is a high integrity risk — an attacker gaining unauthorized access to protected resources — with a low confidentiality impact from potential exposure of data accessible behind the authentication barrier. Availability is not directly affected. Any application using http4k-security-digest for HTTP Digest authentication since 2021 is potentially affected (Github Advisory, http4k Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). Exploitation requires high attack complexity, as it depends on leveraging MD5 collision techniques against the Digest authentication scheme. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is not yet published for this CVE, which remains in "Reserved" status.

1. Identify target: Locate an application using org.http4k:http4k-security-digest (versions ≤ 6.49.0.0, ≤ 5.41.0.0, or ≤ 4.50.0.0) that exposes HTTP Digest authentication endpoints, particularly those configured to use SHA-256.
2. Initiate Digest auth handshake: Send an unauthenticated HTTP request to a protected endpoint to receive a WWW-Authenticate: Digest challenge containing the realm, nonce, and algorithm fields.
3. Exploit MD5 downgrade: Despite the server advertising SHA-256, craft a Digest response using MD5 hashing (since the server verifies with MD5 regardless of configuration). Compute the Digest response hash using MD5 over the standard HA1:nonce:HA2 construction per RFC 7616.
4. Forge credentials: Leverage MD5 collision properties to construct a valid-looking response hash value that passes the server's MD5-based verification, even without knowing the correct password — or simply authenticate using MD5 where SHA-256 was expected to be enforced.
5. Gain unauthorized access: Submit the crafted Authorization: Digest header; the server accepts it as valid, granting access to protected resources (Github Advisory, http4k Advisory).

• Network: HTTP requests to Digest-authenticated endpoints where the Authorization: Digest header specifies algorithm=SHA-256 (or omits the algorithm field) but the server is running a vulnerable version; unexpected successful authentication attempts from unknown or suspicious IP addresses.
• Logs: Application access logs showing successful 200 OK responses to protected endpoints from clients that should not have valid credentials; repeated authentication attempts followed by unexpected success against Digest-protected routes.
• Application Behavior: Successful Digest authentication where the client-supplied algorithm field in the Authorization header does not match the server's configured algorithm, indicating potential exploitation of the algorithm mismatch.

Upgrade to the patched versions immediately: 6.50.0.0 (Community/v6.x), 5.42.0.0 (Enterprise LTS/v5.x), or 4.51.0.0 (Enterprise LTS/v4.x). Enterprise LTS users on v4.x or v5.x should contact enterprise@http4k.org to obtain the patch. For deployments that cannot upgrade immediately, do not rely on the algorithm configuration — assume MD5 is in use and treat Digest credentials as low-trust; consider disabling HTTP Digest authentication entirely and switching to alternative mechanisms such as Bearer tokens or OAuth until patching is possible (Github Advisory, http4k Release).

The vulnerability was disclosed by http4k maintainer daviddenton via a GitHub Security Advisory on June 16, 2026, and published to the GitHub Advisory Database on August 17, 2026. No significant broader media coverage or notable external researcher commentary has been identified at this time (Github Advisory).