CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Attackers can bypass SCRAM-SHA-256 mutual authentication in Apache HttpClient, allowing clients to accept unverified server identities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40542?
CVE-2026-40542 is a high-severity authentication bypass vulnerability in Apache HttpClient, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Which versions are affected by CVE-2026-40542?
2 open source packages ship an affected version, including org.apache.httpcomponents.client5:httpclient5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.httpcomponents.client5:httpclient5 Maven | From 5.6-alpha1 | 5.6.1 |
org.apache.httpcomponents.client5:httpclient5 Maven | From 5.6-alpha1 | 5.6.1 |
Products include Apache Httpclient.
How do I fix CVE-2026-40542?
Upgrade org.apache.httpcomponents.client5:httpclient5 to 5.6.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-40542 being exploited?
There is no known exploitation of CVE-2026-40542 in the wild and no public exploit code.
Other vulnerabilities in Apache HttpClient
- CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default
- CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
- CVE-2025-27820 Apache HttpComponents: PSL (Public Suffix List) validation bypass
- CVE-2012-5783 Improper Certificate Validation in Apache Commons HttpClient
- CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Sources
Also known as ECHO-f0ba-e710-dc08, GHSA-v468-qcjx-r72w, MINI-4x4q-qm9w-jwm2, MINI-ggj3-5mjr-gg92, MINI-pj3f-g56v-g8fq, MINI-vxx8-m29v-f376 and 2 more.