cordova-plugin-advanced-http EUVD-2026-115899

Exploitation requires an app running cordova-plugin-advanced-http 1.5.0-3.3.1 that (1) holds cookies in the plugin's cookie jar for an origin, and (2) issues a request to a URL on that origin which redirects to a different host via an open redirect or an otherwise attacker-influenced redirect, with redirect-following in effect (the default followRedirect:true). When those hold, the native iOS/Android stack forwards the jar-built Cookie (and, per the fix tests, Authorization/Proxy-Authorization) header across the cross-origin hop. Limiting factors that reduce real-world risk: the attacker must be able to cause or influence a redirect to a host they control (no open/attacker-influenced redirect means no leak), cookies/credentials must already exist for the original origin, and only the named plugin versions on native iOS/Android are affected; no authentication is required of the attacker (PR:N) and no user interaction is specified.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.2 (High): network-reachable, no privileges (PR:N, i.e. unauthenticated), no user interaction, high confidentiality impact and no integrity/availability impact - consistent with an information-disclosure flaw (CWE-201) that leaks session cookies. The critical nuance is AT:P (attack requirements present): exploitation is gated on a request being redirected to another host via an open or attacker-influenced redirect, so it is not a fire-at-will remote condition. There is no KEV listing and no EPSS score in the provided data, and no public exploit reference is supplied (only the fix PR and VulnCheck advisory), so exploitation is: no public exploit identified at time of analysis. The vuln.today decision label is this_week, not act_now/emergency, which aligns with a genuine but conditional issue rather than mass exploitation. Net: this is a real priority for apps that embed the plugin and issue requests to hosts where redirects can be influenced, but the dependency on an open/attacker-influenced redirect and the absence of EPSS/KEV/POC signals argue against treating it as a drop-everything emergency. Conflicting-signal note: the 8.2 High severity is driven by AV:N/PR:N, yet the AT:P requirement materially narrows real-world reachability - verify whether target apps actually traverse attacker-influenceable redirects before prioritizing.

A mobile app built on Cordova uses cordova-plugin-advanced-http with cookies stored in its jar and makes a request to a trusted host that can be steered to redirect elsewhere (an open redirect or an attacker-influenced URL). Because the JavaScript layer passes the jar-built Cookie header as an ordinary request header and follows the redirect, the native iOS/Android stack forwards that Cookie header to the attacker-controlled host, handing over the victim's session. No public exploit is identified; the fix PR (#549) includes tests demonstrating that cookies and credentials must be dropped on cross-origin hops.