GitHub Advisoryadvisory · Maven

GHSA-v468-qcjx-r72w Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

HIGH Published 2026-04-22 Modified 2026-04-29 Official page ↗
Aliases
CVE-2026-40542
Ecosystem
Maven
Packages
org.apache.httpcomponents.client5:httpclient5
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-304
Reviewed
2026-04-29

Affected packages

• Maven org.apache.httpcomponents.client5:httpclient5: >= 5.6-alpha1, < 5.6.1 → fixed in 5.6.1

Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-40542 Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256… vulnerability

Weakness · CWE (1)

  • CWE-304 Missing Critical Step in Authentication weakness

References