The vulnerability lies in a missing critical step during SCRAM‑SHA‑256 authentication in Apache HttpClient. Because of this, an attacker can compel the client to accept a SCRAM‑SHA‑256 authentication exchange without the necessary mutual verification, effectively bypassing the intended security check. This bypass allows an attacker to impersonate a legitimate client or service, potentially compromising confidentiality and integrity of all authenticated sessions that rely on this client.

Apache Software Foundation’s Apache HttpClient is affected, specifically version 5.6. The issue is fixed starting with version 5.6.1; earlier releases are vulnerable.

The vulnerability is an authentication bypass (CWE‑304). The CVSS score of 7.3 indicates a high severity, and the EPSS score is below 1 %, implying the likelihood of exploitation is currently low. It is not listed in the CISA KEV catalog. Because the flaw involves the authentication protocol, the likely attack vector is a network‑based request directed at a system that uses HttpClient for SCRAM‑SHA‑256 mutual authentication. The impact is that an attacker can establish a session that the client will treat as authenticated even though mutual verification did not occur. Though exploit data is limited, this loss of authentication control poses a high risk to any application that relies on this client for secure communications.