Impact Analysis

This vulnerability can lead to the leakage of sensitive authentication credentials to unintended third-party domains during HTTP redirects. If an attacker controls or monitors the redirect target, they could capture custom authentication headers and potentially gain unauthorized access to protected resources or services. This increases the risk of data breaches and unauthorized actions performed on behalf of the user or application.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the follow-redirects library prior to version 1.16.0. When an HTTP request follows a cross-domain redirect (such as 301, 302, 307, or 308 status codes), the library only removes standard sensitive headers like authorization, proxy-authorization, and cookie headers. However, it fails to remove any custom authentication headers (for example, X-API-Key, X-Auth-Token, Api-Key, Token), which are forwarded unchanged to the redirect target. This could unintentionally expose sensitive authentication information to unintended domains.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the follow-redirects package to version 1.16.0 or later, where the issue is fixed.

Useful 0 Not Useful 0