CVE-2026-73636
published 2026-10-01CVE-2026-73636: Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle…
PriorityP356high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.40%
33.7th percentile
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
vendor_redhat·2026-10-01·CVSS 8.1
CVE-2026-73636 [HIGH] CWE-294 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in the mod_auth_digest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce (a single-use security toke
VulDB
Apache HTTP Server up to 2.4.68 mod_auth_digest improper authentication (Nessus ID 371929 / WID-SEC-2026-3703)
vuldb·2026-10-26·CVSS 8.1
CVE-2026-73636 [HIGH] Apache HTTP Server up to 2.4.68 mod_auth_digest improper authentication (Nessus ID 371929 / WID-SEC-2026-3703)
A vulnerability labeled as critical has been found in Apache HTTP Server up to 2.4.68. Affected is an unknown function of the component mod_auth_digest. Such manipulation leads to improper authentication.
This vulnerability is referenced as CVE-2026-73636. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
GHSA
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest
ghsa_unreviewed·2026-10-01
CVE-2026-73636 [HIGH] CWE-294 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73636 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest [fedora-all]
bugzilla·2026-10-02·CVSS 8.1
CVE-2026-73636 [HIGH] CVE-2026-73636 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest [fedora-all]
CVE-2026-73636 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Bugzilla
CVE-2026-73636 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
bugzilla·2026-10-01·CVSS 8.1
CVE-2026-73636 [HIGH] CVE-2026-73636 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
CVE-2026-73636 httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
2026-10-01
Published