Is CVE-2026-54148 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54148 being exploited in the wild.

How severe is CVE-2026-54148?

High severity, with a CVSS score of 8.1, published 18 September 2026.

Which products and versions are affected?

Http4k before 6.50.0.0 (v6.x), before 5.42.0.0 (v5.x LTS), before 4.51.0.0 (v4.x LTS); org.http4k:http4k-security-digest (Maven) ECOSYSTEM:introduced=6.0.0.0,fixed=6.50.0.0.

Is there a fix for CVE-2026-54148?

Yes. org.http4k:http4k-security-digest (Maven): upgrade to 6.50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54148 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54148?

Check whether you run Http4k or org.http4k:http4k-security-digest (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54148: http4k DigestAuthProvider request URI validation bypass

CVE-2026-54148 · Severity: high · CVSS 8.1 · Published 2026-09-18

http4k is a Kotlin web framework that includes HTTP Digest authentication support. A flaw in the DigestAuthProvider allowed attackers to replay captured authentication credentials against different URLs within the same realm, bypassing the per-URL binding that Digest authentication is designed to enforce. This could allow an attacker to impersonate legitimate users across multiple endpoints.

Vendors: Http4k, Maven.

Quick answers

Is CVE-2026-54148 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54148 being exploited in the wild.
How severe is CVE-2026-54148?: High severity, with a CVSS score of 8.1, published 18 September 2026.
Which products and versions are affected?: Http4k before 6.50.0.0 (v6.x), before 5.42.0.0 (v5.x LTS), before 4.51.0.0 (v4.x LTS); org.http4k:http4k-security-digest (Maven) ECOSYSTEM:introduced=6.0.0.0,fixed=6.50.0.0.
Is there a fix for CVE-2026-54148?: Yes. org.http4k:http4k-security-digest (Maven): upgrade to 6.50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54148 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54148?: Check whether you run Http4k or org.http4k:http4k-security-digest (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.http4k:http4k-security-digest (Maven): upgrade to 6.50.0.0 or later

# set org.http4k:http4k-security-digest to 6.50.0.0 in your pom.xml or build.gradle

Technical details

The vulnerability exists in DigestAuthProvider.verify, which failed to validate that the `uri` parameter in a client's Digest Authorization header matched the actual request URL. Digest authentication (RFC 7616) binds credentials to a specific request URI to prevent replay attacks; this implementation skipped that check. An attacker who captures a valid Digest authentication response for one URL could replay it against any other URL in the same realm without re-authentication. The fix (commit 725f1b9697) rejects credentials whose URI parameter does not match the request URL. Patches are available in community edition 6.50.0.0 and enterprise LTS editions 5.42.0.0 and 4.51.0.0.

Affected products

http4k http4k before 6.50.0.0 (v6.x), before 5.42.0.0 (v5.x LTS), before 4.51.0.0 (v4.x LTS)

Identifiers

CVE-2026-54148
GHSA-p28p-j94q-pg32

Timeline

2026-08-17: disclosed: GHSA-p28p-j94q-pg32 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.