@@ -18,6 +18,10 @@ This project should adhere to [Semantic Versioning](https://semver.org/spec/v2.0
 
 * `compatibility_hints`: `auth.www-authenticate` records whether the server sends the `WWW-Authenticate` header RFC7235 section 3.1 requires on a 401, and `auth.www-authenticate.usable-scheme` whether the schemes it offers include one this library implements.  A server failing either one never receives your password, and the 401 looks like a rejected one - so it needs `auth_type` pinned in the configuration, and a profile can now say which.  Probed by caldav-server-tester.  See https://github.com/python-caldav/caldav/issues/713.
 
+### Fixed
+
+* A `401` response with no `WWW-Authenticate` header (RFC 7235 §3.1 requires one, but e.g. Yahoo Calendar omits it) left nothing to negotiate with: `build_auth_object()` was never reached, the credentials were never sent, and the bare 401 surfaced as `AuthorizationError` - indistinguishable from a genuinely rejected password.  Over TLS, with no `auth_type`/`auth` already configured, the client now guesses `basic` once before giving up.  See https://github.com/python-caldav/caldav/issues/713.
+
 ## [3.3.1] - 2026-09-16
 
 The two main things in this release:
 
@@ -157,7 +157,11 @@ def __init__(
             username: Username for authentication.
             password: Password for authentication.
             auth: Custom auth object (httpx.Auth or niquests AuthBase).
-            auth_type: Auth type ('bearer', 'digest', or 'basic').
+            auth_type: Auth type ('bearer', 'digest', or 'basic'). If left unset and a 401
+                comes back with no WWW-Authenticate header at all (a server bug per RFC 7235 -
+                seen on Yahoo Calendar), the client guesses 'basic' once, but only over TLS;
+                pin auth_type explicitly to avoid the guess or to reach such a server over
+                plain HTTP.
             timeout: Request timeout in seconds.
             ssl_verify_cert: SSL certificate verification (bool or CA bundle path).
             ssl_cert: Client SSL certificate (path or (cert, key) tuple).
@@ -504,6 +508,15 @@ async def _async_request(
             self.features.set_feature("http.multiplexing", False)
             return await self._async_request(str(url_obj), method, body, headers)
 
+        # Handle a 401 with no WWW-Authenticate at all (issue #713): guess Basic once
+        elif self._should_attempt_unprompted_basic(
+            r.status_code,
+            r.headers,
+            lambda: self._response_scheme(r, url_obj),
+        ):
+            self._build_unprompted_basic_auth()
+            return await self._async_request(url, method, body, headers)
+
         # Raise AuthorizationError for 401/403 responses
         if response.status in (401, 403):
             self._raise_authorization_error(str(url_obj), response)
 
@@ -9,9 +9,10 @@
 
 import logging
 from abc import ABC, abstractmethod
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping
 from datetime import datetime
 from typing import TYPE_CHECKING, Any, NoReturn
+from urllib.parse import urlparse
 
 from lxml import etree
 
@@ -99,6 +100,11 @@ class BaseDAVClient(ABC):
     features: FeatureSet | None = None
     url: Any = None  # URL object, set by subclasses
 
+    # Set once _build_unprompted_basic_auth() has guessed Basic for a bare 401
+    # (see _should_attempt_unprompted_basic); never cleared, so the guess is
+    # only ever made once per client.
+    _unprompted_basic_tried: bool = False
+
     def calendar(self, **kwargs):
         """Returns a calendar object.
 
@@ -247,8 +253,94 @@ def _build_auth_from_401(self, www_authenticate: str) -> None:
                 "supported authentication methods: basic, digest, bearer"
             )
 
+    def _response_scheme(self, response: Any, url_obj: URL) -> str:
+        """Scheme the response actually came back over, falling back to the
+        requested URL and then the client's base URL.
+
+        Both niquests/requests and httpx set ``response.url`` to the final
+        URL after following any redirects - checking that instead of the
+        originally requested ``url_obj`` means a 401 that arrived after an
+        https-to-http redirect is judged by where it actually landed, not by
+        where the request started.
+        """
+        response_url = getattr(response, "url", None)
+        if response_url:
+            scheme = urlparse(str(response_url)).scheme
+            if scheme:
+                return scheme
+        return url_obj.scheme or getattr(self.url, "scheme", "")
+
+    def _should_attempt_unprompted_basic(
+        self, status_code: int, headers: Any, get_scheme: Callable[[], str]
+    ) -> bool:
+        """Return True when a bare 401 (no WWW-Authenticate) warrants a one-shot
+        Basic-auth guess (issue #713).
+
+        RFC 7235 section 3.1 requires a 401 to name a scheme; a server that omits
+        it (e.g. Yahoo Calendar) leaves nothing to negotiate, so
+        ``_should_negotiate_auth`` never fires and the credentials are never
+        sent.  Absent a declared scheme there is no way to pick the *right*
+        one, so this guesses Basic - once, and only:
+
+        - over TLS: never send credentials unprompted towards a plaintext
+          endpoint.
+        - when nothing already picked a scheme: neither ``auth_type`` (which
+          builds the auth object eagerly at init) nor a prior negotiation or
+          guess (which would have already set ``self.auth``) took effect.
+        - when both a username and a password are configured: there is
+          nothing to put in the header otherwise.
+        - only once per client: ``_unprompted_basic_tried`` stays set even
+          after a wrong guess is unwound (see ``_raise_authorization_error``),
+          so a failed guess is not retried on every subsequent request.
+
+        ``get_scheme`` is a callback rather than a plain string so the (lazy,
+        occasionally fragile - see URL.__getattr__) scheme lookup only runs on
+        the rare unchallenged-401 path, not on every request.
+        """
+        if not (
+            status_code == 401
+            and "WWW-Authenticate" not in headers
+            and not self.auth
+            and self.auth_type is None
+            and not self._unprompted_basic_tried
+            and self.username is not None
+            and self.password is not None
+        ):
+            return False
+        return get_scheme() == "https"
+
+    def _build_unprompted_basic_auth(self) -> None:
+        """Build a Basic auth object without a server challenge.
+
+        See ``_should_attempt_unprompted_basic`` for the guard. Sets
+        ``self.auth_type`` so the guess is visible on introspection, same as
+        if the caller had passed ``auth_type="basic"`` themselves.  Marks
+        ``_unprompted_basic_tried`` so the guess is never repeated, even after
+        ``_raise_authorization_error`` unwinds it below.
+        """
+        log.warning(
+            "Server sent 401 without a WWW-Authenticate header (RFC7235 "
+            "violation) - retrying once with Basic auth since no auth_type "
+            "was configured. Pass auth_type='basic' explicitly to silence "
+            "this warning."
+        )
+        self._unprompted_basic_tried = True
+        self.auth_type = "basic"
+        self.build_auth_object()
+
     def _raise_authorization_error(self, url_str: str, reason_source: Any) -> NoReturn:
-        """Raise AuthorizationError, extracting reason from reason_source.reason."""
+        """Raise AuthorizationError, extracting reason from reason_source.reason.
+
+        If this failure is the unprompted-Basic guess coming back wrong (issue
+        #713), unwind it first: clear ``self.auth``/``self.auth_type`` so a
+        *later* request from the same client can still negotiate a
+        server-declared scheme, rather than being permanently stuck sending a
+        guess that has already proven wrong. ``_unprompted_basic_tried`` stays
+        set, so the guess itself is not repeated.
+        """
+        if self._unprompted_basic_tried and self.auth_type == "basic":
+            self.auth = None
+            self.auth_type = None
         try:
             reason = reason_source.reason
         except AttributeError:
 
@@ -204,7 +204,7 @@ def __init__(
           auth: A niquests.auth.AuthBase or requests.auth.AuthBase object, may be passed instead of username/password.  username and password should be passed as arguments or in the URL
           timeout and ssl_verify_cert are passed to niquests.request.
           if auth_type is given, the auth-object will be auto-created. Auth_type can be ``bearer``, ``digest`` or ``basic``. Things are likely to work without ``auth_type`` set, but if nothing else the number of requests to the server will be reduced, and some servers may require this to squelch warnings of unexpected HTML delivered from the
-           server etc.
+           server etc.  If left unset and a 401 comes back with no WWW-Authenticate header at all (a server bug per RFC 7235 - seen on Yahoo Calendar), the client guesses ``basic`` once, but only over TLS; pin auth_type explicitly to avoid the guess or to reach such a server over plain HTTP.
           ssl_verify_cert can be the path of a CA-bundle or False.
           huge_tree: boolean, enable XMLParser huge_tree to handle big events, beware of security issues, see : https://lxml.de/api/lxml.etree.XMLParser-class.html
           features: The default, None, will in version 2.x enable all existing workarounds in the code for backward compability.  Otherwise it will expect a FeatureSet or a dict as defined in `caldav.compatibility_hints` and use that to figure out what workarounds are needed.
@@ -852,6 +852,15 @@ def _sync_request(
             self._build_auth_from_401(r_headers["WWW-Authenticate"])
             return self._sync_request(url, method, body, headers)
 
+        # Handle a 401 with no WWW-Authenticate at all (issue #713): guess Basic once
+        if self._should_attempt_unprompted_basic(
+            r.status_code,
+            r_headers,
+            lambda: self._response_scheme(r, url_obj),
+        ):
+            self._build_unprompted_basic_auth()
+            return self._sync_request(url, method, body, headers)
+
         # Raise AuthorizationError for 401/403 after auth attempt
         if r.status_code in (401, 403):
             self._raise_authorization_error(str(url_obj), r)
 
@@ -1159,6 +1159,113 @@ async def test_rate_limit_max_sleep_stops_adaptive_retries(self):
                 await client.request("/")
 
 
+class TestAsyncUnpromptedBasicAuth:
+    """Issue #713, async side. Mirrors TestUnpromptedBasicAuth in test_caldav_unit.py."""
+
+    def _make_response(self, status_code, headers=None):
+        resp = MagicMock()
+        resp.status_code = status_code
+        resp.headers = headers or {}
+        resp.reason = "Unauthorized" if status_code == 401 else "OK"
+        resp.reason_phrase = resp.reason
+        return resp
+
+    @pytest.mark.asyncio
+    async def test_401_without_www_authenticate_retries_with_basic_over_tls(self):
+        client = AsyncDAVClient(url="https://cal.example.com/", username="user", password="pass")
+        client.session.request = AsyncMock(
+            side_effect=[self._make_response(401), self._make_response(200)]
+        )
+        response = await client.request("/")
+        assert response.status == 200
+        assert client.session.request.call_count == 2
+        assert client.auth_type == "basic"
+        second_call_kwargs = client.session.request.call_args_list[1].kwargs
+        assert second_call_kwargs["auth"] is not None
+
+    @pytest.mark.asyncio
+    async def test_401_without_www_authenticate_over_plain_http_does_not_guess(self):
+        client = AsyncDAVClient(url="http://cal.example.com/", username="user", password="pass")
+        client.session.request = AsyncMock(return_value=self._make_response(401))
+        with pytest.raises(error.AuthorizationError):
+            await client.request("/")
+        assert client.session.request.call_count == 1
+        assert client.auth is None
+
+    @pytest.mark.asyncio
+    async def test_401_without_www_authenticate_does_not_loop_forever(self):
+        client = AsyncDAVClient(url="https://cal.example.com/", username="user", password="pass")
+        client.session.request = AsyncMock(return_value=self._make_response(401))
+        with pytest.raises(error.AuthorizationError):
+            await client.request("/")
+        assert client.session.request.call_count == 2
+
+    @pytest.mark.asyncio
+    async def test_explicit_auth_type_is_not_overridden(self):
+        client = AsyncDAVClient(
+            url="https://cal.example.com/",
+            username="user",
+            password="pass",
+            auth_type="digest",
+        )
+        client.session.request = AsyncMock(return_value=self._make_response(401))
+        with pytest.raises(error.AuthorizationError):
+            await client.request("/")
+        assert client.auth_type == "digest"
+
+    @pytest.mark.asyncio
+    async def test_explicit_auth_object_is_not_overridden(self):
+        client = AsyncDAVClient(
+            url="https://cal.example.com/",
+            username="user",
+            password="pass",
+            auth=object(),
+        )
+        client.session.request = AsyncMock(return_value=self._make_response(401))
+        with pytest.raises(error.AuthorizationError):
+            await client.request("/")
+        assert client.session.request.call_count == 1
+        assert client.auth_type is None
+
+    @pytest.mark.asyncio
+    async def test_401_with_www_authenticate_still_negotiates_normally(self):
+        client = AsyncDAVClient(url="https://cal.example.com/", username="user", password="pass")
+        client.session.request = AsyncMock(
+            side_effect=[
+                self._make_response(401, {"WWW-Authenticate": 'Basic realm="x"'}),
+                self._make_response(200),
+            ]
+        )
+        response = await client.request("/")
+        assert response.status == 200
+        assert client.session.request.call_count == 2
+        assert client.auth is not None
+        assert client.auth_type is None  # negotiation doesn't set auth_type, only auth
+
+    @pytest.mark.asyncio
+    async def test_failed_guess_does_not_stick_and_does_not_retry(self):
+        client = AsyncDAVClient(url="https://cal.example.com/", username="user", password="pass")
+        client.session.request = AsyncMock(return_value=self._make_response(401))
+        with pytest.raises(error.AuthorizationError):
+            await client.request("/")
+        assert client.session.request.call_count == 2
+        assert client.auth is None
+        assert client.auth_type is None
+        assert client._unprompted_basic_tried is True
+
+        # A later request on the same client, now facing a real challenge, still negotiates.
+        client.session.request = AsyncMock(
+            side_effect=[
+                self._make_response(401, {"WWW-Authenticate": 'Digest realm="x"'}),
+                self._make_response(200),
+            ]
+        )
+        response = await client.request("/")
+        assert response.status == 200
+        assert client.auth is not None
+        assert client.auth_type is None
+
+
 class TestAsyncPrincipalCalendar:
     """``principal.calendar()`` must work with async clients.