Digest Authentication Vulnerability in http4k Toolkit for Kotlin Applications
CVE-2026-54147
6.5MEDIUM
What is CVE-2026-54147?
The http4k toolkit for Kotlin applications has a vulnerability in its DigestAuthProvider.verify method that could compromise the security of Digest authentication. Versions prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0 fail to adhere to the configured algorithm parameter, inadvertently using a hardcoded MD5 algorithm for verification, even when deployments are set to use SHA-256. This oversight exposes applications to potential collision-related attack paths due to the weaknesses inherent in the MD5 hash function. Users are strongly encouraged to update to the latest versions to mitigate this security risk.
Affected Version(s)
http4k < 4.51.0.0 < 4.51.0.0
http4k >= 5.0.0.0, < 5.42.0.0 < 5.0.0.0, 5.42.0.0
http4k >= 6.0.0.0, < 6.50.0.0 < 6.0.0.0, 6.50.0.0