An issue in "DigestAuthProvider.verify": Algorithm silently forced to MD5. The configured "algorithm" parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses, including documented attack paths against Digest schemes that rely on the hash being collision-resistant. Who is affected: any application using "http4k-security-digest" for HTTP Digest authentication. The bug has been present since "DigestAuthProvider" was introduced (commit "8a52b615b1", 2021).