CVE-2026-82379— Apache Roller: WSSE digest authentication headers can be replayed
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller 6.1.5 存在通过捕获-重放进行身份验证绕过（Authentication Bypass by Capture-replay）的漏洞。攻击者可捕获一个有效的 WSSE 摘要认证（WSSE digest authentication）请求头并重新发送（重放），从而获取受害者的 AtomPub 权限。原因在于该身份验证机制未强制实施 nonce 的唯一性或时间戳的新鲜性检查。 仅当安装环境启用了非默认的 AtomPub API，并使用了 WSSE 认证以及兼容明文的密码存储方式时，才会受到
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82379
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: WSSE digest authentication headers can be replayed
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.5 | - |
|
II. Public POCs for CVE-2026-82379
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82379
请登录查看更多情报信息。
Other References for CVE-2026-82379 (2)
-
https://lists.apache.org/thread/bg5r225c3z4148z6kf7s3fwwgrs2lx02 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total
| CVE-2026-82377 | 9.9 CRITICAL | Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers |
| CVE-2026-82384 | 9.8 CRITICAL | Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint |
| CVE-2026-82378 | 9.0 CRITICAL | Apache Roller: OAuth authorization endpoint trusts request-supplied identity |
| CVE-2026-82383 | 8.2 HIGH | Apache Roller: Anonymous setup action allows frontpage configuration tampering |
| CVE-2026-82380 | 8.1 HIGH | Apache Roller: CSRF protection bypass via self-generated salt validation |
| CVE-2026-82348 | 7.7 HIGH | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82386 | 7.7 HIGH | Apache Roller: XML external entity processing in OPML bookmark import |
| CVE-2026-82376 | 7.7 HIGH | Apache Roller: XML external entity processing in trackback response parser |
| CVE-2026-82375 | 7.4 HIGH | Apache Roller: Server-side request forgery via entry trackback and enclosure URLs |
| CVE-2026-82385 | 6.5 MEDIUM | Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi |
| CVE-2026-91206 | 6.1 MEDIUM | Apache Roller: Reflected XSS in the optional LDAP comment authenticator |
| CVE-2026-91204 | 6.1 MEDIUM | Apache Roller: Stored javascript: URI in HTML comments |
| CVE-2026-82546 | 6.1 MEDIUM | Apache Roller: Stored cross-site scripting through incoming Trackback links |
| CVE-2026-82382 | 6.1 MEDIUM | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter |
| CVE-2026-86507 | 6.1 MEDIUM | Apache Roller: Stored XSS in comment moderation via comment author URL |
| CVE-2026-82381 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting in the authoring UI |
| CVE-2026-82387 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting via uploaded media content type |
| CVE-2026-90979 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules | |
| CVE-2026-91006 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) |
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring -
CVE-2026-82382
Apache Roller: Reflected cross-site scripting in the frontpa -
CVE-2026-82383
Apache Roller: Anonymous setup action allows frontpage confi
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring
Same weakness: CWE-294
-
CVE-2026-100834
http4k before 6.48.0.0 Digest Authentication Replay Protecti -
CVE-2026-77967
Botslab G980H Dashcams Authentication Bypass by Capture-repl -
CVE-2026-87119
mpp Tempo subscription key authorization is not bound to the -
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack -
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request
V. Comments for CVE-2026-82379
No comments yet