Skip to content
VulniPulse
Sign in
Advisory severityHigh7.7Apache Software Foundation

High [CVE-2026-82379] Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness

This high-severity Apache Software Foundation advisory covers CVE-2026-82379 affecting Apache Roller.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-82379 Source published Source updated

VulniPulse record published Record updated

CVE-2026-82379
Affected products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness.

Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected.

Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.

Affected versions
  • Apache Roller 6.1.5

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Fixed versions
  • 6.1.6

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected.
  • Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.