CVE-2026-91766

Received Received - Intake

Authorization Header Leak via HTTP Redirect in PHP

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: PHP Group

Description

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-91766

Affected Vendors & Products

Vendor	Product	Version / Range
curl	libcurl	to 7.58.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability involves the http:// stream wrapper in PHP forwarding sensitive headers like Authorization, Cookie, and Proxy-Authorization during redirects, even when the redirect target is a different host, port, or downgrades from HTTPS to HTTP. This allows a malicious server to receive credentials intended for another origin.

Detection Guidance

This vulnerability involves improper handling of Authorization, Cookie, and Proxy-Authorization headers during HTTP redirects. To detect it, monitor network traffic for unexpected header forwarding during redirects, especially cross-origin or protocol downgrades. Use tools like tcpdump or Wireshark to capture and inspect HTTP 3xx responses and subsequent requests for header leakage. Check server logs for redirects that include sensitive headers in plaintext or unauthorized domains.

Impact Analysis

An attacker could exploit this to steal authentication credentials or session cookies by tricking users into following malicious redirects. This could lead to unauthorized access to sensitive accounts or data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations and legal consequences.

Mitigation Strategies

Update PHP to a version that includes the fix for this issue. Ensure your PHP configuration disables following redirects with sensitive headers or restricts redirects to trusted hosts and protocols.

Hi! I’m here to help you understand CVE-2026-91766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70