CVE-2026-82379

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description An authentication bypass exists due to a capture-replay flaw in the AtomPub API. An attacker can capture a valid WSSE digest authentication header and replay it to gain the authority of the victim. This occurs because the authentication process fails to enforce timestamp freshness or the uniqueness of the nonce (a random number used once to prevent replay attacks). This issue only affects installations where the non-default AtomPub API is enabled with WSSE authentication and plaintext-compatible password storage.

Recommendations Upgrade Apache Roller to version 6.1.6 or later.