CVE-2026-40542
published 2026-04-22CVE-2026-40542: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper…
PriorityP349high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.46%
37.2th percentile
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | httpclient | — | — |
| apache_software_foundation | apache_httpclient | >= 5.6 < 5.6.1 | 5.6.1 |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
ghsa·2026-04-22
CVE-2026-40542 [HIGH] CWE-304 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
GHSA
GHSA-v468-qcjx-r72w: Missing critical step in authentication in Apache HttpClient 5
ghsa_unreviewed·2026-04-22
CVE-2026-40542 [HIGH] CWE-304 GHSA-v468-qcjx-r72w: Missing critical step in authentication in Apache HttpClient 5
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Red Hat
httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification
vendor_redhat·2026-04-22·CVSS 7.3
CVE-2026-40542 [HIGH] CWE-325 httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification
httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
Package: httpclient (Cryostat 4) - Not affected
Package: mta/mta-cli-rhel9 (Migration Toolkit for Applications 8) - Not affected
Package: mta/mta-java-external-provider-rhel9 (Migration Toolkit for Applications 8) - Not affected
Package: jenkins (OpenShift Developer Tools and Services) - Affected
Package: jenkins-2-plugins (OpenShift Developer Tool
No detection rules found.
No public exploits indexed.
2026-04-22
Published