CVE-2026-54148: http4k: `DigestAuthProvider.verify` did not bind to request URI
(updated )
An issue in DigestAuthProvider.verify:
The uri parameter in the client’s Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes.
Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).
References
- github.com/advisories/GHSA-p28p-j94q-pg32
- github.com/github/advisory-database/pull/9477
- github.com/http4k/http4k/commit/725f1b9697
- github.com/http4k/http4k/commit/725f1b96978dd433348e2b149c1e72b9f5147c90
- github.com/http4k/http4k/releases/tag/6.50.0.0
- github.com/http4k/http4k/security/advisories/GHSA-p28p-j94q-pg32
- nvd.nist.gov/vuln/detail/CVE-2026-54148
Code Behaviors & Features
Detect and mitigate CVE-2026-54148 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →