CVE-2026-107279

Received Received - Intake

Digest Authentication Bypass in AsyncHttpClient

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-107279

Affected Vendors & Products

Vendor	Product	Version / Range
AsyncHttpClient	async-http-client	= 3.0.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-757	A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
CWE-303	The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

Executive Summary

The AsyncHttpClient (AHC) library in version 3.0.12 has a flaw where Digest qop=auth-int authentication can be bypassed. When a peer uses only this authentication method, mutual-authentication verification is skipped. The system fails to properly validate the response authentication (rspauth) value, allowing an unauthenticated peer without the shared secret to be accepted as a legitimate server.

Detection Guidance

This vulnerability affects AsyncHttpClient versions before 3.0.13 when interacting with servers using Digest qop=auth-int. Detection requires checking the library version in use and monitoring HTTP responses for improper authentication handling. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability allows an attacker to impersonate a trusted server, potentially leading to unauthorized access to sensitive data, man-in-the-middle attacks, or data manipulation. Applications using AHC 3.0.12 for HTTP requests could unknowingly communicate with malicious servers.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (health data privacy) by enabling unauthorized access to personal or sensitive data. Compliance requires ensuring data integrity and confidentiality, which this flaw undermines.

Mitigation Strategies

Upgrade the AsyncHttpClient library to version 3.0.13 or later to address the mutual-authentication bypass issue.

Hi! I’m here to help you understand CVE-2026-107279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70