/r/netsec@_r_netsec
CVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018 https://daubois.dev/blog/cve-2026-91766-php-http-redirect-credential-leak/
01022890
33.9K followersView on X
CVE-2026-91766
LOWCVSS 5.9 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
0.0/ 10 priority
Sources & remediation
Weakness type (CWE)
CWE-200CWE-522
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day