An authentication bypass vulnerability in the http4k toolkit allows unauthenticated attackers to replay captured credentials to gain unauthorized access to protected resources.

This is an authentication bypass by capture and replay (CWE-294) occurring within the DigestAuthProvider.verify function, where the application fails to verify the request URI against the provided digest response, effectively allowing an unauthenticated attacker to reuse valid credentials across different endpoints.

Successful exploitation of this vulnerability permits unauthorized access to sensitive read or write operations within affected Kotlin applications. Given the CVSS score of 8.1, this flaw presents a high risk to data integrity and confidentiality, potentially leading to unauthorized data modification or exposure of protected application functions.

Immediate Action: Update the http4k-security-digest dependency to versions 4.51.0.0, 5.42.0.0, or 6.50.0.0, as these releases contain the necessary URI validation logic.

Proactive Monitoring: Security teams should review application access logs for suspicious patterns of repeated authentication tokens or requests that originate from unexpected URI paths.

Compensating Controls: Implement strict network-level access controls or utilize a Web Application Firewall to identify and drop malformed or anomalous HTTP Digest headers until the application can be updated.

Public Exploit Available: Unknown

The severity of this authentication bypass necessitates prompt patching to prevent unauthorized access. Administrators must prioritize updating the http4k library to the specified fixed versions to ensure cryptographic binding between authentication responses and their intended request targets.