Log in Start free

Vulnerability · Published May 14, 2026 · Assigned by GitHub_M

CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High 7.0

In plain English

A high-severity open redirect in github.com/microsoft/kiota-http-go from microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.0High
Exploit odds (30 days)0.6%top 49.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/microsoft/kiota-http-go1.5.5GO-2026-5224
Gogithub.com/microsoft/kiota-http-go1.5.5GHSA-7j59-v9qr-6fq9
Mavencom.microsoft.kiota:microsoft-kiota-abstractions1.9.1GHSA-7j59-v9qr-6fq9
NuGetmicrosoft.kiota.abstractions1.22.0GHSA-7j59-v9qr-6fq9
PyPImicrosoft-kiota-http1.9.9GHSA-7j59-v9qr-6fq9
PyPImicrosoft-kiota-http1.9.9PYSEC-2026-2647
npmkiota-typescript1.0.0-preview.100GHSA-7j59-v9qr-6fq9

Affected products (as reported)

VendorProductVersions
microsoft kiota-java < 1.9.1
microsoft Microsoft.Kiota.Abstractions < 1.22.0
microsoft github.com/microsoft/kiota-http-go < 1.5.5
microsoft kiota-typescript < 1.0.0-preview.100
microsoft microsoft-kiota-abstractions < 1.9.1
microsoft microsoft-kiota-http < 1.9.9

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References