Live › vulnerability › CVE-2026-113440
Go to dashboardThe hackney Erlang HTTP client resends Authorization and Cookie headers when a server redirects to the same host on a different scheme or port. An on-path attacker can read basic auth and cookie credentials sent over cleartext HTTP, or a different local service receives them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications that use hackney from 2.0.0 before 4.9.0 with redirect following enabled and that send Authorization or Cookie credentials through it. Exposure depends on a server returning a same-host redirect to a different scheme or port, so the risk is highest when clients talk to untrusted or on-path networks. Projects not using hackney, or not following redirects with credentials, can skip it.
No product ranges from the sources yet.
rebar.lock or mix.lock (or the dependency tree) and confirm whether it is 2.0.0 or later but before 4.9.0.follow_redirect enabled that send basic_auth or Cookie headers.4.9.0 or later.follow_redirect for requests that carry credentials, or use location_trusted only for targets you control.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.
This issue affects hackney: from 2.0.0 before 4.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-113440")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.