# CVE-2026-107231: AsyncHttpClient Digest authentication downgrade to Basic cleartext password

Source: https://junglewise.ai/threats/cve-2026-107231-asynchttpclient-digest-challenge-without-a-usable-nonce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107231 · Severity: high · CVSS 4 · Published 2026-10-08

AsyncHttpClient is a library that handles HTTP requests with authentication. When a server sends a malformed Digest authentication challenge without a usable nonce, the client incorrectly falls back to Basic authentication and sends the password in base64-encoded cleartext. An attacker who can intercept traffic or compromise a proxy can capture credentials and reuse them against other services.

Technologies: [AsyncHttpClient](https://junglewise.ai/threats/technologies/asynchttpclient). Vendors: [AsyncHttpClient](https://junglewise.ai/threats/vendors/asynchttpclient).

## Quick answers

**Is CVE-2026-107231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107231 being exploited in the wild.

**How severe is CVE-2026-107231?** High severity, with a CVSS score of 4, published 8 October 2026.

**Which products and versions are affected?** AsyncHttpClient 3.0.12 and earlier on 3.x line; 2.16.0 and earlier on 2.x line.

**Is there a fix for CVE-2026-107231?** Yes: fixed in 3.0.13 (3.x line), 2.16.1 (2.x line). Until then: Do not use Digest authentication against servers you do not control, and do not use Digest authentication over plaintext HTTP until you can upgrade.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08","note":"GHSA-rqf5-2wxv-rjf4 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107231 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-107231?** Check whether you run AsyncHttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.13 (3.x line), 2.16.1 (2.x line)

Do not use Digest authentication against servers you do not control, and do not use Digest authentication over plaintext HTTP until you can upgrade.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08","note":"GHSA-rqf5-2wxv-rjf4 published"}]

## Technical details

The vulnerability exists in the parseWWWAuthenticateHeader and parseProxyAuthenticateHeader methods, which infer the authentication scheme based on whether a nonce is present rather than respecting the scheme declared in the challenge. A Digest challenge missing or with an empty nonce triggers a downgrade to Basic, allowing the password to be transmitted in recoverable base64 encoding over plaintext or compromised hops. The attacker must be positioned to write or modify the 401/407 response (malicious server, compromised proxy, or plaintext network path).

## Affected products

- AsyncHttpClient AsyncHttpClient 3.0.12 and earlier on 3.x line; 2.16.0 and earlier on 2.x line

## Identifiers

- CVE-2026-107231
- GHSA-rqf5-2wxv-rjf4

## Related threats

- [AsyncHttpClient resumable download information disclosure and file tampering](https://junglewise.ai/threats/cve-2026-102740-the-asynchttpclient-library-allows-java-applications-to-execute)
- [AsyncHttpClient cookie security bypass in HTTP](https://junglewise.ai/threats/cve-2026-107226-asynchttpclient-cookies-received-over-plaintext-http-can-plant)
- [AsyncHttpClient CookieStore header override via setHeader](https://junglewise.ai/threats/cve-2026-107228-asynchttpclient-cookiestore-silently-overrides-caller-s-explicit)
- [AsyncHttpClient unbounded WebSocket decompression denial of service](https://junglewise.ai/threats/cve-2026-107227-asynchttpclient-unbounded-websocket-permessage-deflate)
- [AsyncHttpClient pooled connection reuse across NTLM and Negotiate logins](https://junglewise.ai/threats/cve-2026-107230-asynchttpclient-pooled-connections-can-still-be-shared-across)