Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An authentication bypass vulnerability was found in libphodav's PUT request handling. The streaming PUT handler in got_headers() processes requests even after libsoup3 has already rejected the message due to authentication failure for a path covered by a SoupAuthDomain. phodav ignores the rejection status and processes the PUT anyway, overwriting the response status. As a result, an unauthenticated client can create or overwrite files within the shared directory even when authentication is configured via htdigest. This issue was introduced by the libsoup3 port (commit c5879e6a, 2022-06-29) and affects phodav 3.0.