Executive brief
http4k is a popular web framework library. Its digest authentication component allows administrators to configure which cryptographic algorithm to use for securing login credentials. However, the component ignored this configuration and always used MD5 (a weak algorithm with known collision vulnerabilities) regardless of what administrators had configured. Organizations believing they deployed stronger encryption—such as SHA-256—were unknowingly using weaker cryptography, reducing the security of user authentication and making credential compromise easier.
Technical details
The vulnerability is a cryptographic algorithm hardcoding issue in DigestAuthProvider.verify (CWE-327). The configured `algorithm` parameter was ignored and every authentication verification hardcoded MD5 instead, bypassing the administrator's choice of stronger alternatives like SHA-256. This affects HTTP Digest authentication (RFC 7616), where the hash function choice is security-critical for resistance to collision attacks and credential interception. The flaw has existed since the DigestAuthProvider was introduced in commit 8a52b615b1 (2021). No authentication is required to trigger the weakness—any HTTP client connecting to a server using http4k-security-digest will use MD5 hashing regardless of server configuration. Patches are available: v6.50.0.0, v5.42.0.0, and v4.51.0.0; the fix changes the code to hash with the configured algorithm instead of hardcoded MD5.
Affected products
- http4k http4k-security-digest all versions <= 6.49.0.0, <= 5.41.0.0, <= 4.50.0.0
Timeline
- 2021: other: Vulnerability first introduced in commit 8a52b615b1 when DigestAuthProvider was added
- 2026-06-16: disclosed: GitHub Security Advisory GHSA-vxxm-wwqh-mh47 published
- 2026-05-31: patched: Fix released in v6.50.0.0 (commit 65d23d99fc)
- 2026-08-17: advisory: CVE-2026-54147 assigned and advisory updated