Bandit EUVD-2026-102317

No authentication, user interaction, or non-default Bandit configuration is required to inject the tainted authority - a remote unauthenticated request against a default Bandit deployment suffices, because RFC 9112 mandates that an absolute-form/authority-form request-target authority override the Host header, and Bandit passed it through unchecked. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the raw port string in conn.port. The SECURITY IMPACT, however, is conditional: it only materializes when the hosting application builds absolute URLs from conn.host/conn.port (e.g. Plug.Conn.request_url/1, Phoenix URL/email link helpers) and uses them in a security-relevant way; apps that never derive URLs from the request authority are not affected. Strong limiting factors: message framing is unaffected, and no CR or LF byte can reach conn.host, so this cannot be used for HTTP request smuggling or response-header/CRLF injection. Affected versions: bandit 0.6.0 up to (not including) 1.13.0.

The vendor-supplied CVSS 4.0 score is 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and impact limited to VI:L (low integrity) - no confidentiality (VC:N) or availability (VA:N) impact. The attack surface is trivially reachable: any remote, unauthenticated client can send a crafted request target over HTTP/1, so AC:L/PR:N/UI:N are well justified. However, the real-world severity hinges entirely on downstream behavior: the flaw only matters when the hosting application builds and trusts absolute URLs derived from conn.host/conn.port (e.g. Plug.Conn.request_url/1 or Phoenix URL helpers) for security-relevant links or redirects - making this effectively an open-redirect / link-poisoning / host-spoofing primitive rather than code execution or data exposure. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation. CONFLICTING SIGNAL: the input Tag 'Information Disclosure' is inconsistent with the vendor vector, which explicitly sets VC:N (no confidentiality impact) - the actual impact is integrity/spoofing of generated URLs, not disclosure; treat the tag with caution. Overall this is a legitimate but moderate-priority defense-in-depth fix: patch during normal cycles, prioritizing Phoenix/Plug apps that emit URLs from the request authority.

A remote unauthenticated attacker sends an HTTP/1.1 request with an absolute-form target such as 'GET http://good.example@evil.example/x HTTP/1.1' plus a valid Host header; per RFC 9112 the request-target authority takes precedence, so Bandit sets conn.host to 'good.example@evil.example' without validation. In a Phoenix app that generates a password-reset or confirmation link via URL helpers, the emitted link now points at the attacker-chosen authority, enabling phishing or token redirection. No public exploit code is identified at time of analysis, though the request line itself is the entire payload and trivial to reproduce.