WS-2026-0114

aiohttp before 3.14.4: when the server receives an absolute-form request target e.g. GET https://host/path, Request.scheme is taken from the attacker-supplied URL instead of the transport, so an http request can report scheme https and spoof secure-context checks redirect/cookie/URL building...