CVE-2026-107285

A flaw was found in async-http-client. When establishing a proxied WebSocket connection through an HTTP tunnel, the client improperly includes proxy authentication headers in the request sent to the destination server. A remote origin server can capture these credentials, leading to information...