AIOHTTP leaks Cookie und Proxy-Authorization headers bei Cross-Origin-Redirects

The primary impact of CVE-2026-34518 is the potential exposure of sensitive data contained within Cookie and Proxy-Authorization headers. These headers often carry authentication tokens, session identifiers, or other credentials. When a user is redirected to a different origin (domain), aiohttp's handling of these headers can inadvertently transmit this information to a third-party server. This could lead to unauthorized access to user accounts, data breaches, or other malicious activities. The risk is amplified in environments where redirects are frequently used, or where sensitive data is routinely transmitted within these headers.

Applications and services built using aiohttp, particularly those that handle user authentication via cookies or proxy authentication, are at risk. This includes web applications, APIs, and microservices that rely on aiohttp for HTTP requests and redirection handling. Environments with legacy authentication schemes or custom cookie implementations are especially vulnerable.

• python / server:

import requests
from urllib.parse import urlparse

def check_redirect_headers(url):
    try:
        response = requests.get(url, allow_redirects=True, stream=True)
        for redirect in response.history:
            if urlparse(redirect.url).netloc != urlparse(response.url).netloc:
                print(f"Redirect to different origin detected: {redirect.url}")
                print(f"Cookie header: {response.cookies.get_dict()}")
                print(f"Proxy-Authorization header: {response.headers.get('Proxy-Authorization')}")
    except Exception as e:
        print(f"Error during request: {e}")

# Example usage
check_redirect_headers("http://example.com/redirect")

1. 2026-04-01Disclosure

   disclosure

2. 2026-04-01Patch

   patch

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-02
4. EPSS aktualisiert2026-04-09

The recommended mitigation for CVE-2026-34518 is to upgrade to aiohttp version 3.13.4 or later. This version includes a fix that properly handles headers during redirects, preventing the leakage of sensitive information. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy server rules to inspect and sanitize headers during redirects. Specifically, configure the WAF to strip or mask Cookie and Proxy-Authorization headers when redirects occur to different origins. Additionally, review application code to avoid relying on the Authorization header when following redirects.