CVE-2026-54148: 
Java vulnerability analysis and mitigation

CVE-2026-54148 is an authentication bypass vulnerability in the http4k-security-digest library (Maven package org.http4k:http4k-security-digest) caused by DigestAuthProvider.verify failing to validate the uri parameter in Digest authentication responses against the actual request URL. This flaw allows a captured Digest authentication response to be replayed against any other URL within the same authentication realm, violating the per-request-URL binding mandated by RFC 7616. The bug has been present since DigestAuthProvider was introduced in commit 8a52b615b1 in 2021. Affected versions include all v4.x up to 4.50.0.0, all v5.x up to 5.41.0.0, and all v6.x up to 6.49.0.0. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, http4k Advisory).

The root cause is classified as CWE-294 (Authentication Bypass by Capture-replay). In the vulnerable code, DigestAuthProvider.verify accepted Digest credentials without comparing the digestUri field in the Authorization: Digest header to the actual URI of the incoming request. The fix, applied in commit 725f1b9697, adds a single check — if (credentials.digestUri != requestUri) return false — and updates the verify function signature to accept the request URI as a parameter. The corresponding filter (ServerFilters.DigestAuth) was also updated to pass request.uri.toString() into the verification call. An attacker who can observe or intercept a valid Digest authentication exchange for one URL (e.g., /public) can reuse those credentials verbatim to authenticate requests to a different, protected URL (e.g., /admin) within the same realm (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to bypass HTTP Digest authentication and gain unauthorized access to any URL protected by the same realm, using credentials captured from a less-sensitive endpoint. The confidentiality and integrity impacts are both rated High, as an attacker could read protected data and perform unauthorized actions (e.g., modifying resources) on behalf of a legitimate user. Availability is not directly impacted. The scope of affected assets includes any http4k application that uses http4k-security-digest for Digest authentication, potentially exposing administrative interfaces or sensitive API endpoints if they share a realm with lower-privilege URLs (GitHub Advisory, http4k Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires user interaction (a legitimate user must first authenticate to a URL within the realm so the attacker can capture the Digest response), which limits opportunistic exploitation. The CVE status is currently "Reserved" and has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify an http4k application using http4k-security-digest for Digest authentication. Determine which URLs share the same authentication realm (e.g., /public and /admin).
2. Capture Digest response: Position to observe network traffic (e.g., via AitM, network tap, or access to proxy logs) and capture a legitimate user's Authorization: Digest header when they authenticate to a lower-privilege URL (e.g., GET /public).
3. Extract credentials: Parse the captured Authorization: Digest header to obtain the username, realm, nonce, uri, response, cnonce, nc, and qop fields.
4. Craft replay request: Construct an HTTP request targeting a different, higher-privilege URL (e.g., GET /admin) within the same realm, but include the captured Authorization: Digest header verbatim — including the original uri=/public parameter.
5. Replay against target URL: Send the crafted request to the server. Because the vulnerable DigestAuthProvider.verify does not check that digestUri matches the actual request URL, the server accepts the credentials and grants access to /admin (GitHub Advisory, Fix Commit).

• Network: HTTP requests to protected endpoints (e.g., /admin) containing an Authorization: Digest header where the uri parameter does not match the request path (e.g., uri="/public" on a request to /admin); repeated Digest authentication attempts to multiple URLs using the same nonce and response values.
• Logs: Application access logs showing successful 200 responses to sensitive endpoints from requests whose Digest uri field references a different URL; the same nonce value appearing in successful authentications to multiple distinct URLs in a short time window.
• Process/Application: Unexpected access to administrative or sensitive API endpoints by accounts that have only previously authenticated to lower-privilege URLs.

Upgrade to the patched versions: 6.50.0.0 (Community/v6.x), 5.42.0.0 (Enterprise LTS/v5.x), or 4.51.0.0 (Enterprise LTS/v4.x). Enterprise LTS users on v4.x or v5.x should contact enterprise@http4k.org to obtain the fix. For deployments that cannot upgrade immediately, place Digest authentication behind a reverse proxy configured to pin requests to a single URL, eliminating the cross-URL replay surface. The underlying fix rejects any Digest credentials whose uri parameter does not exactly match the actual request URL (GitHub Advisory, Release Notes).