CVE-2026-63481
Received Received - Intake

Authorization Cookie Exposure in Hurl HTTP Client via Redirect

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63481
EUVD
EUVD-2026-63465

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
hurl hurl to 8.1.0 (exc)
hurl hurl 8.1.0
orange_opensource hurl 8.0.1
orange_opensource hurl 8.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hurl is a command line tool for testing HTTP requests. In versions 8.0.1 and earlier, it has a vulnerability where redirect handling strips Authorization and Cookie headers but carries cookies from a dedicated [Cookies] section into redirected requests. This allows an attacker-controlled redirect to receive authentication or session cookies meant only for the original host.

Detection Guidance

To detect this vulnerability, check if you are using Hurl version 8.0.1 or earlier. Run the command 'hurl --version' to verify the installed version. If the version is 8.0.1 or below, the system is vulnerable.

Impact Analysis

An attacker could exploit this to steal session cookies or authentication credentials by tricking a user into following a malicious redirect. This could lead to unauthorized access to sensitive accounts or data, depending on the affected application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using vulnerable versions may face compliance risks and potential penalties.

Mitigation Strategies

Upgrade Hurl to version 8.1.0 or later immediately. This can be done using package managers like 'cargo install hurl --version 8.1.0' if installed via Cargo. Remove any vulnerable installations and replace them with the patched version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart