http4k's Digest authentication module before versions 6.48.0.0, 5.42.0.0, and 4.51.0.0 has a vulnerability where the nonceVerifier parameter defaults to accepting every nonce. This means applications using the default setting lack replay protection for Digest authentication, allowing attackers who capture a valid Digest authorization response to replay it indefinitely against the same resource.