Live › vulnerability › CVE-2026-121554
cordova-plugin-advanced-http versions 1.5.0 through 3.3.1 forward Cookie headers to other hosts when a request is redirected. An attacker who controls or influences a redirect can capture the user's cookies and hijack their sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Apps built with Cordova that use cordova-plugin-advanced-http for network requests on iOS or Android, where the app's requests can be redirected to another host. The JavaScript layer passes cookies as normal headers, so native stacks follow redirects and send them along. Apps that do not use this plugin, or that make no cookie-bearing requests, can skip it.
No product ranges from the sources yet.
package.json or config.xml for cordova-plugin-advanced-http between 1.5.0 and 3.3.1cordova-plugin-advanced-http in package-lock.json or yarn.lock to confirm the resolved versioncordova-plugin-advanced-http: move to a version later than 3.3.1 (the advisory's patch link is on GitHub; the exact fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-121554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.