CVE-2026-49996

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...

CVE-2026-49996

Prior to version 1.3.1, SecureDrop Client's securedrop-proxy could be tricked by a malicious SecureDrop Server returning cross-origin redirects, bypassing the proxy's origin restriction and allowing requests to unintended destinations. CVSS 3.7 (Low) reflects network-based, high-complexity exploi...

CVE-2026-49996 securedrop-proxy origin limitation can be bypassed with redirects

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...