The AsyncHttpClient (AHC) library versions >=3.0.8 and <3.0.12 have an improper authentication vulnerability (CWE-287) in the processScramAuthenticationInfo and processAuthenticationInfo functions. These functions compute the SCRAM ServerSignature or Digest rspauth verification result but log mismatches without rejecting the response, allowing acceptance of unauthenticated servers if the transport is not secured by TLS or is compromised. The fix in version 3.0.12 rejects invalid values and computes Digest rspauth from the actual Authorization parameters sent, although some verification gaps remain when values are absent or certain Digest qop modes are used.

An attacker on a non-TLS or compromised transport could impersonate the server without proving knowledge of the shared secret, potentially leading to acceptance of unauthenticated responses. The vulnerability does not impact confidentiality or availability but can lead to integrity issues by accepting unauthenticated server responses.

Upgrade AsyncHttpClient to version 3.0.12 or later, where the improper authentication issue is fixed. No other vendor advisory or patch information is provided, so patch status is confirmed by the stated fixed version. Until upgraded, avoid using AsyncHttpClient over non-TLS transports or in environments where transport security cannot be guaranteed.