CVE-2026-107714

Received Received - Intake

Mechanize Same-Origin Redirect Credential Exposure

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107714

Affected Vendors & Products

Vendor	Product	Version / Range
sparklemotion	mechanize	< 2.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Mechanize library before version 2.14.1 has a vulnerability where redirects are treated as same-origin based only on matching hostnames without properly checking the scheme (HTTP/HTTPS) or port. This can cause sensitive headers like Authorization and Cookie to be sent over unencrypted connections or to unintended ports.

Impact Analysis

An attacker could intercept credentials or session cookies sent over cleartext HTTP during a redirect. This could lead to unauthorized access to user accounts or sensitive data if credentials are exposed.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal data (e.g., cookies, credentials), violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information.

Mitigation Strategies

Update the Mechanize library to version 2.14.1 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-107714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70