Dio HTTP/2 Adapter EUVD-2026-98921

Exploitation requires that the application (a) uses dio_http2_adapter (Http2Adapter) - an optional HTTP/2 plugin, not Dio's default adapter - on a vulnerable version between 1.0.0 and 2.8.0, (b) attaches sensitive headers (Authorization, Cookie, Cookie2, Proxy-Authorization, Proxy-Authenticate, or WWW-Authenticate) to its requests, and (c) follows redirects, which is enabled by default. The attacker must control or compromise the contacted server, or sit on-path, in order to return a cross-origin (different scheme, host, or port) Location redirect. Limiting factors: no effect on apps that do not send credentialed requests through the HTTP/2 adapter, do not follow redirects, or whose servers never issue cross-origin redirects; same-origin redirects are unaffected. No special non-default toggle is needed beyond using the plugin with authenticated requests.

Signals are moderate and mutually consistent, pointing to a credible but conditional risk rather than a mass-exploitation emergency. The NVD CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) scores a network, low-complexity, unauthenticated, high-confidentiality issue with no integrity or availability impact - accurate for a credential-leak flaw. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT on CISA KEV and there is no public exploit identified at time of analysis; the only exploitation evidence is the vendor's own regression test suite in the fix commit, which demonstrates the leak but is not a weaponized POC. No SSVC decision data was supplied. The key tension is the threat model: this is a client-side library flaw, so the 'attacker' must be the remote server the Flutter/Dart application already contacts (or a MITM able to inject a Location header), and it only matters when the app sends Authorization/Cookie/Proxy-Authorization headers via the HTTP/2 adapter and follows a cross-origin redirect. That makes it a targeted credential-interception issue dependent on application behavior, not a wormable remote code execution. Net: real and worth patching for anyone using dio_http2_adapter with authenticated requests, but driven by deployment specifics rather than broad opportunistic scanning.

A Flutter app uses dio_http2_adapter to call an API over HTTP/2 with an Authorization bearer token. A malicious or compromised server (or an on-path attacker injecting a 3xx response) returns a cross-origin Location redirect to attacker.example; the adapter follows it and replays the original Authorization, Cookie, and Proxy-Authorization headers to the attacker's origin, disclosing the credentials. No public exploit is identified, though the vendor's fix commit includes tests that reproduce the cross-origin header leak.