DigestAuth Credential Exposure in AIOHTTP

Compliance Impact

This vulnerability involves the potential leakage of HTTP Digest authentication credentials during cross-origin redirects, which could expose user credentials if exploited.

Such credential leakage could pose risks to data confidentiality and user privacy, which are key concerns in compliance with standards like GDPR and HIPAA.

However, the vulnerability requires an open redirect or similar issue on the target domain to be exploitable, and the attacker only obtains the digest, not plaintext passwords, unless weak cryptography or password reuse is involved.

The issue is fixed in aiohttp version 3.14.1 by scoping credentials to the origin of the first request, preventing unauthorized credential exposure across origins.

Therefore, if unpatched, this vulnerability could increase the risk of unauthorized access to user credentials, potentially impacting compliance with data protection regulations that require safeguarding user authentication data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the leakage of HTTP Digest authentication credentials if an attacker can exploit an open redirect or similar issue on the target domain.

If exploited, an attacker could capture the digest response, potentially allowing them to impersonate the user if weak cryptography or password reuse is involved.

The impact is considered low severity because the attacker does not directly obtain plaintext passwords and must rely on additional weaknesses to fully compromise credentials.

Users can mitigate the risk by upgrading to aiohttp version 3.14.1 or later, which fixes the issue, or by disabling automatic following of redirects.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves DigestAuthMiddleware in aiohttp sending authentication credentials in response to cross-origin redirect challenges. Detection would involve monitoring HTTP Digest authentication responses that occur after cross-origin redirects.

To detect this on your network or system, you can capture and analyze HTTP traffic to identify Digest authentication headers being sent following redirects to different origins.

For example, using command-line tools like tcpdump or Wireshark to capture HTTP traffic and then filtering for Digest authentication headers after redirects could help detect this behavior.

• Use tcpdump to capture HTTP traffic: tcpdump -i <interface> -w capture.pcap port 80 or port 443
• Analyze the capture with Wireshark, filtering for HTTP Digest authentication headers and HTTP 3xx redirect responses.
• Alternatively, use curl with verbose output to manually test endpoints for cross-origin redirects and observe if Digest authentication headers are sent: curl -v --location <URL>

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade aiohttp to version 3.14.1 or later, where the vulnerability is fixed by scoping DigestAuthMiddleware credentials to the origin of the first request.

As a workaround before upgrading, you can disable following redirects in aiohttp clients by setting follow_redirects to false, preventing the middleware from sending credentials after cross-origin redirects.

Additionally, review your application and server configurations to avoid open redirect vulnerabilities that could be exploited in conjunction with this issue.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-54276 is a vulnerability in the aiohttp library's DigestAuthMiddleware prior to version 3.14.1. The middleware could send an authentication response after following a cross-origin redirect, potentially leaking HTTP Digest authentication credentials to an attacker-controlled domain.

To exploit this, an attacker would need an open redirect or similar vulnerability on the target domain to redirect the client to a malicious domain. The attacker would receive the digest authentication response, which contains a hashed form of the user's credentials.

However, the attacker only obtains the digest, not the plaintext password, unless weak cryptography is used or the user reuses passwords. The vulnerability was fixed in aiohttp version 3.14.1 by scoping credentials to the origin of the first request and preventing digest responses from being sent to different origins unless explicitly allowed.

Useful 0 Not Useful 0