Skip to content
feed: live
0dayNews
CVE Record
[ HIGH ]CVE-2026-82379

Apache Roller WSSE Auth Bypass via Digest Replay

Authentication bypass by capture-replay in Apache Roller 6.1.5 WSSE digest auth lets an attacker who intercepts a valid header gain AtomPub authority. CVSS 7.7 high.

cat cve-2026-82379.json
Vendor
Apache Software Foundation
Product
Apache Roller
CVSS
7.7
EPSS (exploit probability)
0.4%
Status
patched
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-82379

Is CVE-2026-82379 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-82379 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).

Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison

CVE-2026-82379 timeline

  1. Published to NVD
  2. First 0dayNews coverage+1d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

CVE-2026-82379 is an authentication bypass by capture-replay vulnerability in Apache Roller 6.1.5. The WSSE digest authentication mechanism used for AtomPub does not track nonces, so an attacker who captures a valid WSSE digest authentication header can replay it to gain the victim’s AtomPub publishing authority.

What to do: Upgrade Apache Roller to a patched version. See the NVD record and the Apache Roller GitHub fix.

Other Apache Software Foundation CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-90910
Apache Answer Missing Auth on Reaction APIwrite-up
[ CRITICAL ]9.80.5%—
CVE-2026-82384
Apache Roller XML-RPC Deserialization Allows Unauthenticated RCEwrite-up
[ CRITICAL ]9.81.0%—
CVE-2026-82383
Apache Roller Missing Auth Lets Attackers Change Site Configurationwrite-up
[ HIGH ]8.20.5%—
CVE-2026-82378
Apache Roller OAuth 1.0a Authorization Bypass Allows Token Theftwrite-up
[ CRITICAL ]9.00.4%—
Related coverage
~/articles/2026-09-29-apache-roller-four-cves-patched
apache

Apache Roller Patches Critical XML-RPC Deserialization Bug

Apache Roller 6.1.5 has four patched vulnerabilities, including a CVSS 9.8 deserialization flaw allowing unauthenticated RCE via the XML-RPC endpoint.

read →