Version:            (using KDE Devel)
Installed from:    Compiled sources
Compiler:          gcc 3.4.6 (compiler is irrelevant here)
OS:                Linux

There is a flaw within the digest authentication code. 
Within the response (Proxy-)Authorization, the values of the 
parameters algorithm and qop are quoted. This is against the 
spec. The response value of algorithm and qop are single tokens, 
cf. rfc2617, "3.2.2 The Authorization Request Header" 
 a) the augmented BNF 
 b) 
 ==== 
  qop 
      Indicates what "quality of protection" the client has applied to 
      the message. If present, its value MUST be one of the alternatives 
      the server indicated it supports in the WWW-Authenticate header. 
      These values affect the computation of the request-digest. Note 
      that this is a single token, not a quoted list of alternatives as 
      in WWW- Authenticate. 
 === 
 
 The value of algorithm is a single token in any case, i.e. without quotes 
 (both within request and response, see rfc2617 "3.2.1 The WWW-Authenticate Response Header") 
 NOTE that the quotes within the 
 augmented BNF do NOT belong to the token nor indicate that the token 
 must be enclosed by quotes (see rfc2616, "2.1 Augmented BNF": 
 === 
    "literal" 
       Quotation marks surround literal text. Unless stated otherwise, 
       the text is case-insensitive. 
 === 
 
This flaw is present up to 3.93.0 (e.g. in 3.5.7 too).

I file it as new because the provided patch of relevant bug #58530,
comment #17 has not been incorporated into the codebase yet.

Repatching is trivial. Please incorporate the changes.