Vulnerability · Published Oct 26, 2026 · Assigned by EEF
CVE-2026-113440HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Medium 6.0
In plain English
A medium-severity security flaw in hackney from benoitc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- Strip basic_auth and cookie on redirects that change scheme or port (benoitc/hackney#979) related
- EEF CNA record for CVE-2026-113440 related
- OSV record EEF-CVE-2026-113440 related
- hackney 4.9.0 release notes vendor-advisory, related
- Introducing commit 8f94455 in benoitc/hackney related
- Fix commit 6548384 in benoitc/hackney patch