CVE-2026-82379

Apache Roller: WSSE digest authentication headers can be replayed

Published Sep 28, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.

Analysis

Technical impact

The flaw allows an attacker who captures a valid WSSE digest authentication header to reuse it and gain access to the victim's AtomPub resources. Because the implementation does not enforce nonce uniqueness or timestamp freshness, a replayed header is treated as fresh and accepted, providing a direct authentication bypass.

Affected Systems

The issue affects Apache Roller installations that use the AtomPub API with WSSE authentication enabled and rely on plaintext‑compatible password storage. Specifically, Apache Roller 6.1.5 and earlier are vulnerable where the non‑default AtomPub service is configured to use WSSE.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity vulnerability with a high impact if exploited. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves network capture of the AtomPub traffic; upon intercepting a WSSE header, an attacker can replay it without modification. The vulnerability remains exploitable until WSSE is disabled or Railsimin upgraded to a version that removes WSSE as an AtomPub authentication method.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Roller

unknown

Version	Status	Constraints
`6.1.5`	affected	—

No data.

Vendor Product Versions

Apache

Roller

Version	Status	Scheme	Platform
`6.1.5`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache Roller to version 6.1.6 or later, where WSSE is removed from the AtomPub authentication methods.
If an upgrade is not immediately possible, disable WSSE authentication for the AtomPub API and configure a supported method such as Basic or OAuth.
Ensure that password storage is not plaintext‑compatible; enforce secure hashing or encryption for stored passwords.
Apply HTTPS to the AtomPub endpoint to prevent network capture of authentication headers.

Generated by OpenCVE AI on September 28, 2026 at 09:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.370% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/09/25/12
https://github.com/apache/roller/pull/166
https://lists.apache.org/thread/bg5r225c3z4148z6kf7s3fwwgrs2lx02

History

Sep 30, 2026 5:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 28, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache roller
Vendors & Products		Apache Apache roller

Sep 28, 2026 9:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/09/25/12

Sep 28, 2026 8:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.
Title		Apache Roller: WSSE digest authentication headers can be replayed
Weaknesses		CWE-294
References		https://github.com/apache/roller/pull/166 https://lists.apache.org/thread/bg5r225c3z4148z6kf7s3fwwgrs2lx02
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L'}`