CVE-2026-69212

Received Received - Intake

Authorization Header Leak in Http4s via HTTPS-to-HTTP Redirect

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP therefore preserves credentials and transmits them over a plaintext connection. An attacker who can induce the downgrade and observe the network can capture those sensitive headers from applications using FollowRedirect. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-69212

EUVD

EUVD-2026-79186

Affected Vendors & Products

Vendor	Product	Version / Range
http4s	http4s	to 0.23.35 (exc)
http4s	http4s	to 1.0.0-M47 (exc)
http4s	http4s	0.23.35
http4s	http4s	1.0.0-M47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the FollowRedirect middleware in the http4s client library. It allows sensitive headers like Authorization and Cookie to be leaked when an HTTPS to HTTP redirect occurs on the same domain. The middleware only strips these headers if the redirect authority changes, but same-domain redirects preserve credentials, exposing them in plaintext during the insecure hop.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP to HTTPS downgrades where sensitive headers like Authorization or Cookie are transmitted in plaintext. Use tools like Wireshark or tcpdump to capture and inspect HTTP redirects from HTTPS to HTTP on the same domain. Check application logs for FollowRedirect middleware usage in http4s versions before 0.23.35 or 1.0.0-M47.

Impact Analysis

An attacker who can observe network traffic during a same-domain HTTPS to HTTP redirect could capture sensitive credentials like session tokens or cookies. This could lead to unauthorized access to user accounts or sensitive data if the credentials are reused elsewhere.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing sensitive user credentials in transit. Organizations using affected http4s versions may fail to meet requirements for protecting personal or health data during transmission.

Mitigation Strategies

Immediately upgrade http4s to version 0.23.35 or 1.0.0-M47 or later. If upgrading is not possible, disable FollowRedirect middleware for clients handling sensitive credentials or configure a sensitiveHeaderFilter to strip headers during redirects. Avoid same-authority HTTPS to HTTP redirects for applications using http4s.

Hi! I’m here to help you understand CVE-2026-69212. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70