Skip to main content

Erlang/OTP inets CVE-2026-48856

| EUVDEUVD-2026-36058 HIGH
URL Redirection to Untrusted Site (Open Redirect) (CWE-601)
2026-06-10 EEF
Information Disclosure Open Redirect Otp
7.1
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 10, 2026 - 16:39 vuln.today
Analysis Generated
Jun 10, 2026 - 16:39 vuln.today
CVSS changed
Jun 10, 2026 - 16:22 NVD
7.1 (HIGH)

DescriptionCVE.org

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data.

The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host.

autoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects.

An attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header.

This vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl.

This issue affects OTP from 17.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to inets from 5.10 before 9.7.1, 9.6.2.2 and 9.3.2.6.

AnalysisAI

Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows attacker-controlled servers to harvest Authorization and Proxy-Authorization headers by issuing cross-origin 3xx redirects. Because httpc_response:redirect/2 only updates the host field and copies all other headers verbatim - and autoredirect defaults to true - any httpc caller using HTTP Basic auth or URL userinfo silently forwards credentials to the redirect target. No public exploit identified at time of analysis, but the fix has been published upstream and tagged in vendor-released OTP patch versions.

Technical ContextAI

The vulnerable code lives in lib/inets/src/http_client/httpc_response.erl within the OTP inets application, which provides the httpc HTTP client used widely across Erlang and Elixir ecosystems (via :httpc and libraries like hackney's fallbacks, rebar3, and OTP's own update mechanisms). The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect) compounded with sensitive data exposure: when handling a 3xx response, the redirect/2 function builds a new request record by mutating only the host field, leaving authorization, proxy_authorization, cookie, referer, and origin headers intact regardless of whether the new target is on a different origin. RFC 9110 §15.4 explicitly requires stripping these headers on cross-origin redirects, and the patched code now compares Request#request.address against the redirect target and clears the sensitive fields when host or port differ. Credentials passed via URL userinfo (http://user:pass@host) are particularly exposed because httpc_request:handle_user_info/2 transparently converts them into a Basic Authorization header that the caller may not realize is being forwarded.

RemediationAI

Vendor-released patch: upgrade to OTP 29.0.2, 28.5.0.2, or 27.3.4.13 (or equivalently inets 9.7.1, 9.6.2.2, or 9.3.2.6) per the GHSA-m75x-4vwg-ggjh advisory and commit 688d748d6f7a6a06b13b662a1d3de8af97079612. If immediate upgrade is not feasible, explicitly disable automatic redirect following by passing {autoredirect, false} in httpc:request/4-5 HTTPOptions and handle 3xx responses manually in application code - note this changes behavior for any code that relied on transparent redirect following and may require updates to downstream call sites. As an additional compensating control, avoid embedding credentials in URLs (the userinfo form) and avoid sending Authorization headers to URLs sourced from untrusted input; where feasible, route external fetches through an egress proxy that strips Authorization headers on redirects. The Erlang version ordering reference at https://www.erlang.org/doc/system/versions.html#order-of-versions can help confirm whether a deployed build is on or past the fix line.

More in Open Redirect

View all
CVE-2017-1000117 HIGH POC
8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
CVE-2024-52875 HIGH POC
8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
CVE-2016-5385 HIGH POC
8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
CVE-2013-2248 MEDIUM POC
5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
CVE-2012-6499 MEDIUM POC
5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM POC
4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
CVE-2017-3528 MEDIUM POC
5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
CVE-2012-0518 MEDIUM
4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
CVE-2024-21641 MEDIUM POC
6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2015-5354 MEDIUM POC
5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM POC
6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL POC
9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all
CVE-2017-1000117 HIGH POC
8.8
CVE-2016-5385 HIGH POC
8.1
CVE-2017-3528 MEDIUM POC
5.4
CVE-2012-0518 MEDIUM
4.7
CVE-2024-21641 MEDIUM POC
6.5
CVE-2015-5354 MEDIUM POC
5.8
CVE-2024-22891 CRITICAL POC
9.8
CVE-2022-40083 CRITICAL POC
9.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-48856 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy