{
  "_pruva_terminal_reconciliation": {
    "authored_artifact_closure_sha256": "064d89ad5ebde9a6b8c577df324bfae35c1a88e5e7168f3c5631958155e7435d",
    "authored_runtime_manifest_sha256": "962573d6f17dd2dd8be82968a6780f4f8bd04a7c923a69934e4f7be47a8c1b7a",
    "authored_verdict_sha256": "30b3836aa2700c56946a231890b7566075b9115c4cb7ee4bcb8ff8737de40a39",
    "claim_matching": "evaluated",
    "schema_version": 2,
    "status": "completed"
  },
  "attacker_controlled_input": "forged Authorization: Digest header for an unknown username (attacker-unknown-user) computed with the empty HA1 secret the vulnerable secretDigest() returns; response = MD5(\":\"+nonce+\":00000001:83cfda9a:auth:\"+MD5(\"GET:/protected/\"))",
  "claim_outcome": "confirmed",
  "claimed_impact_class": "authz_bypass",
  "claimed_surface": "api_remote",
  "crash_observed": false,
  "end_to_end_target_reached": true,
  "evidence_scope": "production_path",
  "exploit_chain_demonstrated": true,
  "exploitability_confidence": "high",
  "inferred": false,
  "observed_impact_class": "authz_bypass",
  "read_write_primitive_observed": false,
  "repro_result": "confirmed",
  "sanitizer_used": false,
  "trigger_path": "HTTP GET /protected/ on a digestAuth-protected Traefik router -> pkg/middlewares/auth/digest_auth.go secretDigest() returns \"\" for unknown user -> pinned containous/go-http-auth fork CheckAuth() accepts empty HA1 -> request forwarded to protected backend (HTTP 200)",
  "validated_surface": "api_remote"
}