GHSA-3MR9-P497-58F6 Contao crawler leaks auth credentials to external hosts

Summary Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony...

Information Disclosure axios Dependency in Jira Service Management Data Center

This High severity Information Disclosure vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2...

SUSE CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

EulerOS 2.0 SP13 : perl-libwww-perl (EulerOS-SA-2026-3037)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects. On a 3xx...

GHSA-H4MF-4V27-HGGJ rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

EUVD-2026-53362

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. Authorizatio...

CVE-2026-71277

Affected software: rust-iot-platform, specifically the AuthToken request-guard in api/src/main.rs. Vulnerability: the guard only checks for the presence of the Authorization header, with no validation against sessions, token stores, or signatures. Any non-empty header (e.g., Authorization: fake) ...

CVE-2026-71277 rust-iot-platform Authentication Bypass via Non-Validated Authorization Header

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-71277 rust-iot-platform Authentication Bypass via Non-Validated Authorization Header

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-71203

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

PT-2026-68150

Name of the Vulnerable Software and Affected Versions rust-iot-platform affected versions not specified Description The AuthToken request-guard implementation in api/src/main.rs fails to validate the value of the Authorization HTTP header against a session, token store, or signature. It only...

PYSEC-2026-3578 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

Summary lib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...

PYSEC-2026-3563 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Summary When datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

SummaryWhen datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Impact Undici's cache interceptor mishandles optional whitespace OWS placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" OWS before = or no-cache= "authorization" OWS after =. The parser either drops the directive entirely or stores a...

GHSA-9WX3-P993-35VP Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q8q-rj6j-mhjq. This link is maintained to preserve external references. Original Description axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when th...

Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xj6q-8x83-jv6g. This link is maintained to preserve external references. Original Description axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling...

CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...