# CVE-2026-85716: AsyncHttpClient SCRAM and Digest mutual authentication verification bypass

Source: https://junglewise.ai/threats/cve-2026-85716-asynchttpclient-scram-and-digest-mutual-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85716 · Severity: low · CVSS 3.7 · Published 2026-09-17

AsyncHttpClient is a widely-used HTTP client library used by many applications to communicate with web services. The library failed to validate that remote servers actually possess the correct authentication credentials during SCRAM and Digest authentication exchanges, accepting unverified responses as if authentication had succeeded. While the risk is minimal over encrypted HTTPS connections, this creates a security gap over unencrypted or already-compromised network links where an attacker could impersonate the legitimate server without being detected.

Technologies: [AsyncHttpClient](https://junglewise.ai/threats/technologies/asynchttpclient), [org.asynchttpclient:async-http-client (Maven)](https://junglewise.ai/threats/technologies/org-asynchttpclient-async-http-client). Vendors: [AsyncHttpClient](https://junglewise.ai/threats/vendors/asynchttpclient), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-85716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85716 being exploited in the wild.

**How severe is CVE-2026-85716?** Low severity, with a CVSS score of 3.7, published 17 September 2026.

**Which products and versions are affected?** AsyncHttpClient 3.0.8 through 3.0.11; org.asynchttpclient:async-http-client (Maven) >= 3.0.8, <= 3.0.11, ECOSYSTEM:introduced=3.0.8,fixed=3.0.12.

**Is there a fix for CVE-2026-85716?** Yes. org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85716 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85716?** Check whether you run AsyncHttpClient or org.asynchttpclient:async-http-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.12 or later

  ```sh
  # set org.asynchttpclient:async-http-client to 3.0.12 in your pom.xml or build.gradle
  ```


## Technical details

AsyncHttpClient versions 3.0.8 through 3.0.11 contain an authentication bypass in SCRAM and Digest mutual-authentication handling. The client correctly computes the server's verification value (SCRAM ServerSignature or Digest rspauth) but fails to enforce it; when verification fails, the library only logs the failure and still delivers the response as a successful authentication result. This is a mutual authentication bypass: a server that does not know the shared secret is accepted, eliminating the client's only detection mechanism for impostor servers on unencrypted transports. The vulnerability requires either non-TLS transport or pre-compromised TLS to be exploitable. The fix (version 3.0.12+) fails the request when a present verification parameter does not verify, though limitations remain for requests omitting the authentication info header or using Digest with qop="auth-int".

## Affected products

- AsyncHttpClient AsyncHttpClient 3.0.8 through 3.0.11

## Identifiers

- CVE-2026-85716
- GHSA-fj9w-c36g-h5x8

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 3.0.12; version 3.0.13 addresses an additional related Digest downgrade issue

## Related threats

- [AsyncHttpClient resumable download information disclosure and file tampering](https://junglewise.ai/threats/cve-2026-102740-the-asynchttpclient-library-allows-java-applications-to-execute)
- [AsyncHttpClient cookie security bypass in HTTP](https://junglewise.ai/threats/cve-2026-107226-asynchttpclient-cookies-received-over-plaintext-http-can-plant)
- [AsyncHttpClient CookieStore header override via setHeader](https://junglewise.ai/threats/cve-2026-107228-asynchttpclient-cookiestore-silently-overrides-caller-s-explicit)
- [AsyncHttpClient unbounded WebSocket decompression denial of service](https://junglewise.ai/threats/cve-2026-107227-asynchttpclient-unbounded-websocket-permessage-deflate)
- [AsyncHttpClient pooled connection reuse across NTLM and Negotiate logins](https://junglewise.ai/threats/cve-2026-107230-asynchttpclient-pooled-connections-can-still-be-shared-across)