EUVD-2026-81905
GHSA-f8m2-889x-vw4x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Remote, no auth or UI against the client (AV:N/PR:N/UI:N); AC:H for the required config plus attacker-controlled cross-origin redirect and 401; credentials leak to a different origin (S:C, C:H), no integrity/availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 7 maven packages depend on org.asynchttpclient:async-http-client (4 direct, 3 indirect)
Ecosystem-wide dependent count for version 3.0.9.
DescriptionCVE.org
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.
AnalysisAI
Credential disclosure in AsyncHttpClient (Java) allows a client configured with a client-wide Realm via config.setRealm(...) and with redirect following enabled to leak Basic, Digest, Negotiate, or NTLM credentials to an attacker-controlled origin. When a cross-origin or scheme-downgrade redirect clears the per-exchange realm, the authentication interceptor in Interceptors.java falls back to config.getRealm() and re-attaches the client-wide credentials; if the attacker's target then answers HTTP 401, the client sends those credentials or tokens to that foreign origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires ALL of: (1) the AsyncHttpClient client is configured with a client-wide Realm via config.setRealm(...) - per-request realms are stripped correctly and are NOT vulnerable; (2) redirect following is enabled (setFollowRedirect(true)); (3) the attacker can control, compromise, or influence a response so the client follows a cross-origin (or scheme-downgrade) redirect to an attacker origin; and (4) that attacker origin returns HTTP 401 to solicit authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but conditional credential-disclosure flaw, best treated as a targeted rather than mass-exploitation risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to AsyncHttpClient 2.16.1 (2.x line) or 3.0.12 (3.x line), which replace the Interceptors fallback to config.getRealm() with future.getRealm() so that a realm cleared by a cross-origin or scheme-downgrade redirect is never re-derived from client configuration - see the advisory at https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f8m2-889x-vw4x and the fix in pull request 2224 / commits 43db7bba81430cbd61ec2dc2c7be464e0ff6a0ff and b66757bec34def2e9867bb2b77bd848b1112abb4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today