CVE-2026-82379: Apache Roller WSSE Auth Bypass Vulnerability

CVE-2026-82379 Overview

CVE-2026-82379 is an authentication bypass vulnerability in Apache Roller 6.1.5 affecting the AtomPub API when configured with WS-Security Extension (WSSE) authentication. An attacker who captures a valid WSSE digest authentication header can replay it to gain the victim's AtomPub authority. The flaw exists because the authentication implementation does not enforce nonce uniqueness or timestamp freshness, allowing captured credentials to be reused indefinitely. The vulnerability is classified under [CWE-294: Authentication Bypass by Capture-replay].

Critical Impact

An attacker who intercepts a single WSSE digest header can impersonate the victim across the AtomPub API, gaining their full publishing authority on the Roller instance.

Affected Products

• Apache Roller 6.1.5 and earlier versions with the non-default AtomPub API enabled
• Installations configured to use WSSE authentication for AtomPub
• Deployments relying on plaintext-compatible password storage required for WSSE digest validation

Discovery Timeline

• 2026-09-28 - CVE-2026-82379 published to the National Vulnerability Database (NVD)
• 2026-09-29 - Last updated in the NVD database

Technical Details for CVE-2026-82379

Vulnerability Analysis

Apache Roller is a Java-based blog server supporting multiple publishing protocols, including AtomPub. When administrators enable AtomPub with WSSE authentication, each request includes an X-WSSE header containing a username, a password digest, a nonce, and a creation timestamp. The server computes the expected digest from the stored password and compares it to the submitted value.

The vulnerable implementation accepts any syntactically valid WSSE header without validating that the nonce has not been seen before or that the timestamp falls within a recent time window. An attacker who observes a legitimate request, through network interception, log exposure, or proxy telemetry, can resubmit the identical header to the Roller server. The server processes the replayed request as if it originated from the legitimate user.

Successful replay grants the attacker whatever AtomPub permissions the victim account holds, including publishing, editing, and deleting blog entries.

Root Cause

The root cause is the absence of two mandatory WSSE replay protections: nonce tracking and timestamp freshness enforcement. The WSSE UsernameToken specification requires servers to reject requests whose nonces have been previously accepted and whose creation timestamps fall outside a short validity window. Apache Roller 6.1.5 implements neither check. The design also requires plaintext-compatible password storage, which weakens password confidentiality independently of the replay flaw.

Attack Vector

Exploitation requires an attacker to obtain a valid WSSE digest header. Capture scenarios include passive network observation on unencrypted or downgraded transports, access to intermediate proxy or load balancer logs, and compromise of client-side storage retaining historical headers. Once captured, the attacker issues HTTP requests to the AtomPub endpoint with the stolen X-WSSE header. No credential cracking, token refresh, or interactive session is required. The attack succeeds for the entire validity of the backing password.

No public proof-of-concept exploit is listed for this CVE at publication time. Refer to the Apache Mailing List Thread and GitHub Pull Request #166 for the upstream discussion and fix.

Detection Methods for CVE-2026-82379

Indicators of Compromise

• Repeated AtomPub requests from different source IP addresses carrying identical X-WSSE header values, nonces, or creation timestamps
• AtomPub publishing, editing, or deletion activity originating from IP addresses that do not match the user's historical access patterns
• Blog entries created or modified outside the account owner's normal working hours or geolocation

Detection Strategies

• Enable verbose HTTP request logging on the Roller front-end web server and parse X-WSSE nonce values to flag duplicates
• Correlate AtomPub request timestamps against the embedded WSSE Created field to detect stale or reused tokens
• Alert on AtomPub traffic from source networks that have never previously authenticated to the application

Monitoring Recommendations

• Forward web server access logs and application audit logs to a centralized analytics platform for nonce-reuse correlation across sessions
• Monitor the Roller admin interface for configuration drift that re-enables WSSE after an upgrade
• Track AtomPub endpoint request volume and alert on spikes consistent with scripted replay activity

How to Mitigate CVE-2026-82379

Immediate Actions Required

• Upgrade Apache Roller to version 6.1.6 or later, which removes WSSE as a supported AtomPub authentication method
• Audit the Roller configuration and disable the AtomPub API where it is not required for business operations
• Rotate passwords for any account that previously authenticated to AtomPub using WSSE, since replay windows cannot be bounded retroactively
• Review web server, proxy, and load balancer logs for exposed X-WSSE headers and purge historical copies

Patch Information

Apache Roller 6.1.6 removes WSSE as an AtomPub authentication option. Existing installations configured for WSSE fail closed after upgrade until an administrator explicitly selects a supported authentication method. Review the GitHub Pull Request #166 for the fix implementation and the Openwall OSS-Security Update for the vendor advisory.

Workarounds

• Disable the AtomPub API entirely in the Roller configuration until the upgrade is applied
• Switch the AtomPub authentication method away from WSSE if an alternative is available in the deployed version
• Terminate TLS at the Roller server itself and enforce HTTPS-only access to reduce passive capture opportunities
• Restrict AtomPub endpoint access to known administrative source IP ranges using firewall or reverse-proxy rules

# Configuration example: disable AtomPub in roller-custom.properties
webservices.atomPubEnabled=false

# Restrict AtomPub endpoint at the reverse proxy (nginx example)
location /roller-services/app {
    allow 10.0.0.0/24;
    deny all;
}