Guzzle HTTP Client CVE-2026-67354

Exploitation requires three simultaneous conditions: (1) the Guzzle client must be configured with allow_redirects => ['referer' => true] explicitly set - this option is disabled by default and must be deliberately enabled by the developer; (2) the initial request URI must contain a sensitive value in its fragment portion (after '#'), such as an access token, one-time password, OAuth state parameter, or session identifier placed there by the calling application; and (3) the HTTP response must be a same-scheme redirect (e.g., HTTPS to HTTPS, not HTTPS to HTTP) to a destination under attacker control or with lower trust than the originating host. Applications that leave the referer option at its default of false, do not embed sensitive data in URI fragments, do not follow redirects, or only redirect within the same trust boundary are not vulnerable. Exploitation is limited to server-side PHP applications making outbound HTTP requests - end-user browsers are not directly affected.

The CVSS 4.0 score of 8.2 must be contextualized against the AT:P (specific attack requirements present) and AC:H (high complexity) metrics - exploitation requires a non-default configuration, sensitive data in URI fragments, and a same-scheme redirect to an attacker-controlled destination, all simultaneously. No CISA KEV listing exists and no confirmed public exploit or POC has been identified, making opportunistic mass exploitation unlikely. The VC:H rating is justified when all conditions align, as entire authentication tokens or one-time secrets could be disclosed to an unintended third party. Real-world risk is meaningfully lower than the headline score for most deployments where the referer option is disabled by default. Organizations should prioritize patching in applications that explicitly enable the referer redirect option or that embed sensitive data in URI fragments, as those are the only deployments at meaningful risk.

An attacker operates a web server that issues same-scheme HTTPS redirects to attacker-controlled infrastructure. A PHP application using Guzzle with allow_redirects.referer enabled requests a URI such as https://trusted.example.com/reset#token=abc123; Guzzle follows the redirect and transmits a Referer header containing the full URI including the fragment to the attacker's server, where the token is readable from access logs or application code. No public exploit code has been identified at time of analysis.