Executive brief
http4k is a Kotlin web framework that includes HTTP Digest authentication support. A flaw in the DigestAuthProvider allowed attackers to replay captured authentication credentials against different URLs within the same realm, bypassing the per-URL binding that Digest authentication is designed to enforce. This could allow an attacker to impersonate legitimate users across multiple endpoints.
Technical details
The vulnerability exists in DigestAuthProvider.verify, which failed to validate that the `uri` parameter in a client's Digest Authorization header matched the actual request URL. Digest authentication (RFC 7616) binds credentials to a specific request URI to prevent replay attacks; this implementation skipped that check. An attacker who captures a valid Digest authentication response for one URL could replay it against any other URL in the same realm without re-authentication. The fix (commit 725f1b9697) rejects credentials whose URI parameter does not match the request URL. Patches are available in community edition 6.50.0.0 and enterprise LTS editions 5.42.0.0 and 4.51.0.0.
Affected products
- http4k http4k before 6.50.0.0 (v6.x), before 5.42.0.0 (v5.x LTS), before 4.51.0.0 (v4.x LTS)
Timeline
- 2026-08-17: disclosed: GHSA-p28p-j94q-pg32 published