GHSA-3MR9-P497-58F6 Contao crawler leaks auth credentials to external hosts

Summary Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony...

Contao crawler leaks auth credentials to external hosts

Summary Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony...

PT-2026-66843

Name of the Vulnerable Software and Affected Versions Contao versions 4.13.40 through 5.3.46 Contao versions 5.7.0-RC1 through 5.7.6 Description The crawler in this Open Source CMS leaks authentication credentials to external hosts. The system attempts to protect confidential HTTP client options ...