CVE-2026-100834

The record

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.

Affected packages

Related vulnerabilities

• CVE-2026-104381 A missing authentication vulnerability in Fireware OS's FireCluster state synchronization… CWE-294
• CVE-2026-41020 Eaton easyE4 uses a static nonce during authentication, which could allow an… CWE-294
• CVE-2026-117470 Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn… CWE-294
• CVE-2026-116201 Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows… CWE-294
• CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-294
• CVE-2026-114617 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-294
• CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service… CWE-294
• CVE-2026-103314 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). CWE-294