A timing attack targeting the mod_auth_digest module of Apache HTTP Server allows a remote attacker to bypass Digest authentication by measuring response times. The flaw is a CWE-208 side‑channel vulnerability, letting attackers infer credential information and register as authenticated users without valid credentials, undermining the integrity of authentication controls.

The vulnerable product is Apache HTTP Server from Apache Software Foundation. Versions 2.4.66 and earlier contain mod_auth_digest with the timing flaw; any deployment using these releases is affected.

The CVSS score of 4.8 indicates medium severity. The vulnerability is not listed in the CISA KEV catalog, and no EPSS data is available, so the exact exploitation probability is unknown. Nevertheless, the ability to defeat authentication remotely makes the attack especially concerning. The likely attack vector is remote, with an attacker sending repeated authenticated requests to observe timing differences.