Skip to main content

aiohttp CVE-2026-54276

| EUVDEUVD-2026-38313 MEDIUM
Information Exposure (CWE-200)
2026-06-15 https://github.com/aio-libs/aiohttp GHSA-hpj7-wq8m-9hgp
Information Disclosure Open Redirect
6.3
CVSS 4.0 · Vendor: https://github.com/aio-libs/aiohttp
Share

Severity by source

Vendor (https://github.com/aio-libs/aiohttp) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.1 LOW

AC:H reflects the open-redirect precondition; UI:R because the victim client must initiate the redirected request; C:L since only the digest hash is exposed, not plaintext credentials.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
3.7 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat
3.1 LOW
qualitative

Primary rating from Vendor (https://github.com/aio-libs/aiohttp).

CVSS VectorVendor: https://github.com/aio-libs/aiohttp

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jun 22, 2026 - 18:23 NVD
6.3 (MEDIUM)
Source Code Evidence Fetched
Jun 15, 2026 - 20:33 vuln.today
Analysis Generated
Jun 15, 2026 - 20:33 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 87 pypi packages depend on aiohttp (44 direct, 44 indirect)

Ecosystem-wide dependent count for version 3.14.1.

DescriptionCVE.org

Summary

`DigestAuthMiddleware` can send an authentication response after following a cross-origin redirect.

Impact

If the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.

This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.

Workaround

Disable `follow_redirects` if this is a concern.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa

AnalysisAI

DigestAuthMiddleware in aiohttp leaks HTTP Digest authentication credentials to attacker-controlled cross-origin redirect targets. Applications using DigestAuthMiddleware with the default follow_redirects behavior are affected in versions up to and including 3.14.0. When a server responds with a cross-origin redirect, the middleware incorrectly computes and sends a digest authentication response to the redirect destination, exposing the auth digest to the third-party domain. No public exploit has been identified at time of analysis, but exploitation is plausible wherever an open redirect exists on the origin server.

Technical ContextAI

aiohttp is a popular Python async HTTP client/server framework (pkg:pip/aiohttp). The DigestAuthMiddleware implements RFC 7616 HTTP Digest Access Authentication on the client side. The root cause (CWE-200: Exposure of Sensitive Information) is that the middleware failed to scope credentials to the origin of the first request it handled. When the HTTP client followed a redirect to a different origin (the default behavior), the middleware would still compute and attach a Digest Authorization header using the configured credentials, effectively forwarding the digest response to the cross-origin destination. The fix, applied in commit 38d16060, pins credentials to the anchor origin on the first request and passes requests to other origins through untouched unless that origin is explicitly covered by an RFC 7616 domain directive from the anchor origin.

RemediationAI

Upgrade aiohttp to version 3.14.1, which scopes DigestAuthMiddleware credentials to the origin of the first request and prevents cross-origin digest responses (vendor patch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa, advisory: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp). As a workaround prior to patching, pass follow_redirects=False on requests using DigestAuthMiddleware; the trade-off is that any server-side redirect will no longer be followed automatically, which may break flows relying on HTTP 3xx responses. If disabling redirect following breaks application behavior, restricting DigestAuthMiddleware use to internal, fully-trusted origins reduces exposure until patching is possible.

More in Open Redirect

View all
CVE-2017-1000117 HIGH POC
8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
CVE-2024-52875 HIGH POC
8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
CVE-2016-5385 HIGH POC
8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
CVE-2013-2248 MEDIUM POC
5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
CVE-2012-6499 MEDIUM POC
5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM POC
4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
CVE-2017-3528 MEDIUM POC
5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
CVE-2012-0518 MEDIUM
4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
CVE-2024-21641 MEDIUM POC
6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2015-5354 MEDIUM POC
5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM POC
6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL POC
9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-54276 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy