CVE-2026-73636

Summary

The flaw allows a man-in-the-middle attacker to bypass authentication by replaying captured digest credentials, posing a significant security risk.

Exploitability

Exploitation is moderately difficult requiring a man-in-the-middle position and the ability to capture and replay credentials. Precondition is the AuthDigestNonceLifetime being set to 0.

Blast radius

If exploited, the impact is high, as it compromises the integrity of the authentication mechanism, allowing unauthorized access to protected resources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache HTTP Server 2.4.69 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.