The vulnerability in http4k's Digest authentication module stems from a default nonceVerifier that always validates any nonce. This means that every received nonce is considered legitimate, regardless of its age or previous usage. As a consequence, an attacker who can capture a valid Authorization: Digest header can replay that header indefinitely against the same protected resource, effectively bypassing replay protections and gaining unauthorized access to resources that the Digest mechanism was meant to secure.

The affected product is the http4k library, specifically the org.http4k:http4k-security-digest component. All releases before 6.48.0.0, 5.42.0.0, and 4.51.0.0 are vulnerable. Applications that depended on the library’s default nonceVerifier setting are at risk.

The CVSS score of 8.2 places this issue in the high severity range, and it is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation at the time of analysis. Attackers would typically need to capture a valid Authorization: Digest response—through passive eavesdropping on unencrypted traffic or accessing server logs—and then replay that response. While no code execution or privilege escalation is required, the ability to replay credentials allows persistent unauthorized access to all resources protected by the vulnerable Digest authentication implementation. The exploit is feasible in environments where the attacker can observe network traffic or read logs, and it can be performed without interaction with the victim.