Executive brief
AsyncHttpClient is a widely-used HTTP client library used by many applications to communicate with web services. The library failed to validate that remote servers actually possess the correct authentication credentials during SCRAM and Digest authentication exchanges, accepting unverified responses as if authentication had succeeded. While the risk is minimal over encrypted HTTPS connections, this creates a security gap over unencrypted or already-compromised network links where an attacker could impersonate the legitimate server without being detected.
Technical details
AsyncHttpClient versions 3.0.8 through 3.0.11 contain an authentication bypass in SCRAM and Digest mutual-authentication handling. The client correctly computes the server's verification value (SCRAM ServerSignature or Digest rspauth) but fails to enforce it; when verification fails, the library only logs the failure and still delivers the response as a successful authentication result. This is a mutual authentication bypass: a server that does not know the shared secret is accepted, eliminating the client's only detection mechanism for impostor servers on unencrypted transports. The vulnerability requires either non-TLS transport or pre-compromised TLS to be exploitable. The fix (version 3.0.12+) fails the request when a present verification parameter does not verify, though limitations remain for requests omitting the authentication info header or using Digest with qop="auth-int".
Affected products
- AsyncHttpClient AsyncHttpClient 3.0.8 through 3.0.11
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 3.0.12; version 3.0.13 addresses an additional related Digest downgrade issue