CVE-2026-40542 is a vulnerability in Apache HttpClient 5.6 involving a missing critical step in the SCRAM-SHA-256 authentication process. This omission causes the client to accept authentication without proper mutual authentication verification, potentially allowing an attacker to bypass authentication guarantees. The vulnerability is categorized under CWE-304 (Missing Authentication for Critical Function) and CWE-325 (Missing Required Cryptographic Step). The CVSS v3.1 base score is 7.3 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The vendor advisory from Red Hat recommends upgrading to version 5.6.1, which addresses the issue.

The vulnerability allows an attacker to bypass proper mutual authentication in SCRAM-SHA-256, potentially leading to unauthorized access or impersonation. This impacts the confidentiality, integrity, and availability of communications relying on Apache HttpClient 5.6 for authentication.

Users should upgrade Apache HttpClient from version 5.6 to 5.6.1 or later, where this vulnerability is fixed. No other mitigations are specified in the vendor advisory. Patch status is confirmed by the vendor advisory recommending upgrade to 5.6.1.