Vulnerability in http4k Security Digest Allows Unauthorized Access
CVE-2026-54148
8.1HIGH
What is CVE-2026-54148?
The http4k security digest toolkit for Kotlin applications contains a vulnerability in the DigestAuthProvider's verification mechanism. Prior to specific version updates, the toolkit failed to correctly validate the URI parameter in Digest authentication responses. This oversight allows an attacker to capture a valid Digest authentication response and reuse it to gain unauthorized access to other URLs within the same realm. The issue has been addressed in versions 4.51.0.0, 5.42.0.0, and 6.50.0.0, which now enforce proper per-request URI checking.
Affected Version(s)
http4k < 4.51.0.0 < 4.51.0.0
http4k >= 5.0.0.0, < 5.42.0.0 < 5.0.0.0, 5.42.0.0
http4k >= 6.0.0.0, < 6.50.0.0 < 6.0.0.0, 6.50.0.0