CVE-2026-113440
Awaiting Analysis Awaiting Analysis - Queue

Insufficiently Protected Credentials in hackney

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-113440
EUVD
EUVD-2026-109835

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
benoitc hackney 2.0.0
benoitc hackney 8f944559bdb83da60b5c06f6cf6d842591278364

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the hackney HTTP client library allows a redirecting server to obtain basic_auth and cookie credentials via same-host redirects to another scheme or port. When follow_redirect is enabled, the library reissues requests without properly checking the full URL, only comparing hostnames. This can expose credentials in cleartext or send them to unintended services.

Detection Guidance

To detect this vulnerability, check if your system uses hackney versions between 2.0.0 and 4.9.0. Run: `hackney:version().` in an Erlang shell or check dependency files like mix.lock or rebar.lock for hackney entries. Monitor network traffic for redirects that change scheme or port while retaining credentials.

Impact Analysis

An attacker could intercept credentials during redirects, leading to unauthorized access to sensitive data. Credentials sent in cleartext or to unintended services may allow session hijacking or replay attacks. Systems using hackney versions 2.0.0 to 4.9.0 are affected.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection. Exposure of credentials may result in non-compliance with data security standards.

Mitigation Strategies
  • Upgrade hackney to version 4.9.0 or later to apply the credential-stripping fix during redirects.
  • Disable follow_redirect if possible or avoid using basic_auth and cookie options in requests that may redirect.
  • If upgrading is not feasible, avoid using hackney for requests that may redirect to untrusted targets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart