An authentication bypass vulnerability was found in libphodav's PUT request handling. The streaming PUT handler in got_headers() processes requests even after libsoup3 has already rejected the message due to authentication failure for a path covered by a SoupAuthDomain. phodav ignores the rejection status and processes the PUT anyway, overwriting the response status. As a result, an unauthenticated client can create or overwrite files within the shared directory even when authentication is configured via htdigest. This issue was introduced by the libsoup3 port (commit c5879e6a, 2022-06-29) and affects phodav 3.0.