CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed
Apache Roller 6.1.5 lets attackers replay captured WSSE digest headers to bypass AtomPub authentication.
CVE-2026-82379 is a capture-replay authentication bypass in Apache Roller 6.1.5, rated Moderate with a CVSS 3.1 score of 7.7. An attacker who captures a valid WSSE digest authentication header can replay it and gain the victim's AtomPub authority. Authentication does not enforce nonce uniqueness or timestamp freshness. The attack is network-based with high complexity, requires no privileges or user interaction, and has high confidentiality and integrity impact with low availability impact.
- CVE-2026-82379 affects Apache Roller 6.1.5.
- Captured WSSE digest headers can be replayed for AtomPub access.
- Nonce uniqueness and timestamp freshness are not enforced.
- CVSS 3.1 is 7.7; the vendor rates it Moderate.
- CVEs
- CVE-2026-82379
- Vendors
- Apache Software Foundation
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82379 | WSSE capture-replay auth bypass in Apache Roller 6.1.5 | 7.7 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Moderate CVSS 3. 1: 7.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.