CVE-2026-40542

CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

Vendor Apache Software Foundation

Product Apache HttpClient

Weakness CWE-304

Published April 22, 2026

Last update July 15, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Key dates

02Disclosure timeline

April 22, 2026 CVE published

July 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40542 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/304.html AskarLabs — CWE-304 write-up Missing Critical Step in Authentication

Related vulnerabilities

CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

01Description

02Disclosure timeline

03References

04Related CVE