CVE-2026-85716: AsyncHttpClient SCRAM and Digest mutual authentication verification bypass

CVE-2026-85716 · Severity: low · CVSS 3.7 · Published 2026-09-17

AsyncHttpClient is a widely-used HTTP client library used by many applications to communicate with web services. The library failed to validate that remote servers actually possess the correct authentication credentials during SCRAM and Digest authentication exchanges, accepting unverified responses as if authentication had succeeded. While the risk is minimal over encrypted HTTPS connections, this creates a security gap over unencrypted or already-compromised network links where an attacker could impersonate the legitimate server without being detected.

Technologies: AsyncHttpClient, org.asynchttpclient:async-http-client (Maven). Vendors: AsyncHttpClient, Maven.

Quick answers

Is CVE-2026-85716 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85716 being exploited in the wild.
How severe is CVE-2026-85716?
Low severity, with a CVSS score of 3.7, published 17 September 2026.
Which products and versions are affected?
AsyncHttpClient 3.0.8 through 3.0.11; org.asynchttpclient:async-http-client (Maven) >= 3.0.8, <= 3.0.11, ECOSYSTEM:introduced=3.0.8,fixed=3.0.12.
Is there a fix for CVE-2026-85716?
Yes. org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85716 attacked?
It is attacked over the network.
Am I affected by CVE-2026-85716?
Check whether you run AsyncHttpClient or org.asynchttpclient:async-http-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later
    # set org.asynchttpclient:async-http-client to 3.0.12 in your pom.xml or build.gradle

Technical details

AsyncHttpClient versions 3.0.8 through 3.0.11 contain an authentication bypass in SCRAM and Digest mutual-authentication handling. The client correctly computes the server's verification value (SCRAM ServerSignature or Digest rspauth) but fails to enforce it; when verification fails, the library only logs the failure and still delivers the response as a successful authentication result. This is a mutual authentication bypass: a server that does not know the shared secret is accepted, eliminating the client's only detection mechanism for impostor servers on unencrypted transports. The vulnerability requires either non-TLS transport or pre-compromised TLS to be exploitable. The fix (version 3.0.12+) fails the request when a present verification parameter does not verify, though limitations remain for requests omitting the authentication info header or using Digest with qop="auth-int".

Affected products

  • AsyncHttpClient AsyncHttpClient 3.0.8 through 3.0.11

Identifiers

  • CVE-2026-85716
  • GHSA-fj9w-c36g-h5x8

Timeline

  • 2026-09-17: disclosed
  • 2026-09-17: patched: Fixed in version 3.0.12; version 3.0.13 addresses an additional related Digest downgrade issue

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.