Authentication Bypass in AsyncHttpClient Library by AsyncHttpClient
CVE-2026-107279

8.8HIGH

Key Information:

Vendor

Asynchttpclient

Status
Async-http-client
Vendor
CVE Published:
7 October 2026

What is CVE-2026-107279?

The AsyncHttpClient library, used in Java applications for executing HTTP requests, contains a vulnerability where a peer offering only Digest qop=auth-int can cause mutual-authentication verification to be skipped. Due to the design in version 3.0.12, the AuthenticatorUtils.computeExpectedRspAuth function fails to return an expected value for auth-int. As a result, Interceptors misinterpret this as a non-fatal error and accept responses with invalid rspauth values. This weakness allows unauthorized peers, unaware of the shared secret, to be wrongly recognized as authenticated servers. The issue has been addressed in version 3.0.13.

Affected Version(s)

async-http-client = 3.0.12

References

https://github.com/AsyncHttpClient/async-http-client/secu...
x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/comm...
x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/rele...
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.