CVE-2026-3099
published 2026-03-12CVE-2026-3099: A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or…
PriorityP354high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.36%
28.0th percentile
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup2.4 | — | — |
| debian | libsoup3 | — | — |
| msrc | azl3_libsoup_3.4.4-12_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libsoup_3.0.4-12_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
osv7.3HIGH
vendor_debian5.8MEDIUM
vendor_msrc5.8MEDIUM
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Libsoup: libsoup: authentication bypass via digest authentication replay attack
vendor_msrc·2026-03-10·CVSS 5.8
CVE-2026-3099 [MEDIUM] CWE-323 Libsoup: libsoup: authentication bypass via digest authentication replay attack
Libsoup: libsoup: authentication bypass via digest authentication replay attack
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Red Hat
libsoup: Libsoup: Authentication bypass via digest authentication replay attack
vendor_redhat·2026-02-24·CVSS 5.8
CVE-2026-3099 [MEDIUM] CWE-323 libsoup: Libsoup: Authentication bypass via digest authentication replay attack
libsoup: Libsoup: Authentication bypass via digest authentication replay attack
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability al
Debian
CVE-2026-3099: libsoup2.4 - A flaw was found in Libsoup. The server-side digest authentication implementatio...
vendor_debian·2026·CVSS 5.8
CVE-2026-3099 [MEDIUM] CVE-2026-3099: libsoup2.4 - A flaw was found in Libsoup. The server-side digest authentication implementatio...
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
Scope: local
bookworm: open
bullseye: open
trixie: open
GHSA
GHSA-hrf3-6c7v-5628: A flaw was found in Libsoup
ghsa_unreviewed·2026-03-12
CVE-2026-3099 [MEDIUM] CWE-323 GHSA-hrf3-6c7v-5628: A flaw was found in Libsoup
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
OSV
CVE-2026-3099: A flaw was found in Libsoup
osv·2026-03-12·CVSS 7.3
CVE-2026-3099 [HIGH] CVE-2026-3099: A flaw was found in Libsoup
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-3099 libsoup: Libsoup: Authentication bypass via digest authentication replay attack
bugzilla·2026-02-24·CVSS 7.3
CVE-2026-3099 [HIGH] CVE-2026-3099 libsoup: Libsoup: Authentication bypass via digest authentication replay attack
CVE-2026-3099 libsoup: Libsoup: Authentication bypass via digest authentication replay attack
DESCRIPTION
Here, I had found another flaw in Libsoup's server-side digest authentication implementation. The SoupAuthDomainDigest class fails to track issued nonces or enforce the incrementing nonce-count (nc) attribute required by the Digest Auth standard.
The validation logic in check_hex_urp performs a purely mathematical verification. It recomputes the expected hash without verifying if the nonce was actually generated by the server or if the nc value is being reused. This allows an attacker who captures a single valid Authorization header to replay it indefinitely, bypassing authentication and accessing protected resources as the victim.
VULNERABILITY DETAILS
The vulnerability exists in
Wiz
CVE-2026-3099 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.8
CVE-2026-3099 [MEDIUM] CVE-2026-3099 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3099 :
Linux Debian vulnerability analysis and mitigation
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
Source : NVD
## 7.3
Score
Published March 12, 2026
Severity HIGH
CNA Score 5.8
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation
2026-03-12
Published