CVE-2026-3099CWE-323

Libsoup: libsoup: authentication bypass via digest authentication replay attack

Medium · published March 12, 2026

CVSS v3.1
5.8
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.0th percentile
Weakness
CWE-323 · Reusing a Nonce, Key Pair in Encryption
Published
2026-03-12T13:53Z
EPSS history
Timeline
  • 12 MAR 13:53Z
    Libsoup: libsoup: authentication bypass via digest authentication replay attack
    cvelistv5