Vulnerability-Lookup

GHSA-M347-HM9W-WWV9

Vulnerability from github – Published: 2026-10-26 15:34 – Updated: 2026-10-26 15:34

Details

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.

This issue affects hackney: from 2.0.0 before 4.9.0.

Severity

6.0 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-113440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-26T14:16:28Z",
    "severity": "MODERATE"
  },
  "details": "Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0.",
  "id": "GHSA-m347-hm9w-wwv9",
  "modified": "2026-10-26T15:34:41Z",
  "published": "2026-10-26T15:34:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113440"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/pull/979"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-113440.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-113440"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-113440 (GCVE-0-2026-113440)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:49 – Updated: 2026-10-26 13:49

Title

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

Summary

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 345 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/benoitc/hackney/pull/979	related
https://cna.erlef.org/cves/CVE-2026-113440.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-113440	related
https://github.com/benoitc/hackney/releases/tag/4.9.0	vendor-advisoryrelated
https://github.com/benoitc/hackney/commit/8f94455…	related
https://github.com/benoitc/hackney/commit/6548384…	patch

Impacted products

2 products

Vendor	Product	Version
benoitc	hackney	Affected: 2.0.0 , < 4.9.0 (semver) cpe:2.3:a:benoitc:hackney::::::::
benoitc	hackney	Affected: 8f944559bdb83da60b5c06f6cf6d842591278364 , < 6548384b22ea196023a1963e2967d5715b6d9564 (git) cpe:2.3:a:benoitc:hackney::::::::

Date Public

2026-10-25 00:00

Credits

Martin Karrer Martin Karrer Benoit Chesneau Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "hackney"
          ],
          "packageName": "hackney",
          "packageURL": "pkg:hex/hackney",
          "product": "hackney",
          "programFiles": [
            "src/hackney.erl"
          ],
          "programRoutines": [
            {
              "name": "hackney:request/5"
            },
            {
              "name": "hackney:follow_redirect/10"
            },
            {
              "name": "hackney:maybe_strip_auth_on_redirect/3"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "vendor": "benoitc",
          "versions": [
            {
              "lessThan": "4.9.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "hackney"
          ],
          "packageName": "benoitc/hackney",
          "packageURL": "pkg:github/benoitc/hackney",
          "product": "hackney",
          "programFiles": [
            "src/hackney.erl"
          ],
          "programRoutines": [
            {
              "name": "hackney:request/5"
            },
            {
              "name": "hackney:follow_redirect/10"
            },
            {
              "name": "hackney:maybe_strip_auth_on_redirect/3"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "vendor": "benoitc",
          "versions": [
            {
              "lessThan": "6548384b22ea196023a1963e2967d5715b6d9564",
              "status": "affected",
              "version": "8f944559bdb83da60b5c06f6cf6d842591278364",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe request is made with \u003ccode\u003efollow_redirect\u003c/code\u003e enabled and the \u003ccode\u003ebasic_auth\u003c/code\u003e or \u003ccode\u003ecookie\u003c/code\u003e option set, over HTTP/1.1 or HTTP/2, without \u003ccode\u003elocation_trusted\u003c/code\u003e. Credentials passed as explicit request headers are not forwarded on redirects and are not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The request is made with `follow_redirect` enabled and the `basic_auth` or `cookie` option set, over HTTP/1.1 or HTTP/2, without `location_trusted`. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."
            }
          ],
          "value": "The request is made with follow_redirect enabled and the basic_auth or cookie option set, over HTTP/1.1 or HTTP/2, without location_trusted. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.0",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Martin Karrer"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Martin Karrer"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benoit Chesneau"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-26T10:04:03.000Z",
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficiently Protected Credentials vulnerability in \u003ccode\u003ehackney\u003c/code\u003e in benoitc hackney allows a redirecting server to obtain the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e credentials of a request via a same-host redirect to another scheme or port. With \u003ccode\u003efollow_redirect\u003c/code\u003e enabled, \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e in \u003ccode\u003esrc/hackney.erl\u003c/code\u003e reissues the request to the \u003ccode\u003eLocation\u003c/code\u003e target after \u003ccode\u003ehackney:maybe_strip_auth_on_redirect/3\u003c/code\u003e, which compared only the hostname of the current and the redirect URL. A redirect from \u003ccode\u003ehttps\u003c/code\u003e to \u003ccode\u003ehttp\u003c/code\u003e on the same host resent the \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. \u003ccode\u003elocation_trusted\u003c/code\u003e forwards credentials to any target by design and is unchanged.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.9.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Insufficiently Protected Credentials vulnerability in `hackney` in benoitc hackney allows a redirecting server to obtain the `basic_auth` and `cookie` credentials of a request via a same-host redirect to another scheme or port. With `follow_redirect` enabled, `hackney:follow_redirect/10` in `src/hackney.erl` reissues the request to the `Location` target after `hackney:maybe_strip_auth_on_redirect/3`, which compared only the hostname of the current and the redirect URL. A redirect from `https` to `http` on the same host resent the `Authorization` and `Cookie` headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. `location_trusted` forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
            }
          ],
          "value": "Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-102",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s `Authorization` and `Cookie` headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."
                }
              ],
              "value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s Authorization and Cookie headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:49:17.377Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "Strip basic_auth and cookie on redirects that change scheme or port (benoitc/hackney#979)",
          "tags": [
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/pull/979"
        },
        {
          "name": "EEF CNA record for CVE-2026-113440",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-113440.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-113440",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-113440"
        },
        {
          "name": "hackney 4.9.0 release notes",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
        },
        {
          "name": "Introducing commit 8f94455 in benoitc/hackney",
          "tags": [
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"
        },
        {
          "name": "Fix commit 6548384 in benoitc/hackney",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDisable \u003ccode\u003efollow_redirect\u003c/code\u003e and handle the \u003ccode\u003eLocation\u003c/code\u003e header in the application, or pass the credentials as explicit \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e request headers instead of the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e options. \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e issues the redirected request with an empty header list, so explicit headers reach the first server only.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Disable `follow_redirect` and handle the `Location` header in the application, or pass the credentials as explicit `Authorization` and `Cookie` request headers instead of the `basic_auth` and `cookie` options. `hackney:follow_redirect/10` issues the redirected request with an empty header list, so explicit headers reach the first server only."
            }
          ],
          "value": "Disable follow_redirect and handle the Location header in the application, or pass the credentials as explicit Authorization and Cookie request headers instead of the basic_auth and cookie options. hackney:follow_redirect/10 issues the redirected request with an empty header list, so explicit headers reach the first server only."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Redirect handling.\u003c/strong\u003e With \u003ccode\u003efollow_redirect\u003c/code\u003e set, \u003ccode\u003ehackney:request/5\u003c/code\u003e hands a 3xx response to \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e in \u003ccode\u003esrc/hackney.erl\u003c/code\u003e, which resolves the \u003ccode\u003eLocation\u003c/code\u003e header against the current URL and calls \u003ccode\u003ehackney:request/5\u003c/code\u003e again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Host-only comparison.\u003c/strong\u003e Before the new request, \u003ccode\u003ehackney:maybe_strip_auth_on_redirect/3\u003c/code\u003e removes the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e options when the redirect leaves the current host, unless \u003ccode\u003elocation_trusted\u003c/code\u003e is set. It compared \u003ccode\u003e#hackney_url.host\u003c/code\u003e of the two URLs.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Consequence.\u003c/strong\u003e A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers. From \u003ccode\u003ehttps\u003c/code\u003e to \u003ccode\u003ehttp\u003c/code\u003e they travel in cleartext; to another port they reach a different service on the same host.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Redirect handling.** With `follow_redirect` set, `hackney:request/5` hands a 3xx response to `hackney:follow_redirect/10` in `src/hackney.erl`, which resolves the `Location` header against the current URL and calls `hackney:request/5` again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n**2. Host-only comparison.** Before the new request, `hackney:maybe_strip_auth_on_redirect/3` removes the `basic_auth` and `cookie` options when the redirect leaves the current host, unless `location_trusted` is set. It compared `#hackney_url.host` of the two URLs.\n\n**3. Consequence.** A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same `Authorization` and `Cookie` headers. From `https` to `http` they travel in cleartext; to another port they reach a different service on the same host."
            }
          ],
          "value": "1. Redirect handling. With follow_redirect set, hackney:request/5 hands a 3xx response to hackney:follow_redirect/10 in src/hackney.erl, which resolves the Location header against the current URL and calls hackney:request/5 again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n2. Host-only comparison. Before the new request, hackney:maybe_strip_auth_on_redirect/3 removes the basic_auth and cookie options when the redirect leaves the current host, unless location_trusted is set. It compared #hackney_url.host of the two URLs.\n\n3. Consequence. A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same Authorization and Cookie headers. From https to http they travel in cleartext; to another port they reach a different service on the same host."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-113440",
    "datePublished": "2026-10-26T13:49:17.377Z",
    "dateReserved": "2026-10-26T10:00:02.149Z",
    "dateUpdated": "2026-10-26T13:49:17.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted