python: Python: Information disclosure due to incorrect URL scheme matching

A flaw was found in Python. The HTTPPasswordMgr class in the urllib.request module did not correctly consider the URL scheme when matching stored credentials against a requested URL. This allowed credentials intended for an HTTPS secure connection to be sent over an unencrypted HTTP connection to...

CVE-2026-15806: Cleartext Transmission of Sensitive Information

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...