CVE-2026-82379 describes an authentication bypass vulnerability in Apache Roller version 6.1.5. The flaw arises because WSSE digest authentication headers can be captured and replayed by an attacker, due to lack of enforcement of nonce uniqueness and timestamp freshness. This allows unauthorized access with the victim's AtomPub authority. The vulnerability only affects installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage. The issue is addressed in Apache Roller 6.1.6 and later, which remove WSSE as an authentication method for AtomPub.

An attacker who captures a valid WSSE digest authentication header can replay it to bypass authentication and gain the victim's AtomPub authority. This can lead to unauthorized access and potentially high confidentiality and integrity impact on the affected system. Availability impact is low. The vulnerability requires the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage to be enabled.

Users should upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method. Existing installations configured for WSSE authentication will fail closed until an administrator explicitly selects a supported authentication method. This effectively mitigates the vulnerability.