{"id":"CVE-2026-121554","kind":"vulnerability","aliases":["CVE-2026-121554"],"related":[],"title":"cordova-plugin-advanced-http: redirects leak session cookies to third-party hosts","description":"cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.","summary":"cordova-plugin-advanced-http versions 1.5.0 through 3.3.1 forward Cookie headers to other hosts when a request is redirected. An attacker who controls or influences a redirect can capture the user's cookies and hijack their sessions.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","cordova","ios","mobile","package","session-hijack"],"not_affected_if":["no-cookie-requests","plugin-not-installed"],"how_to_check":"- Check the installed version in the project's `package.json` or `config.xml` for `cordova-plugin-advanced-http` between `1.5.0` and `3.3.1`\n- Look for `cordova-plugin-advanced-http` in `package-lock.json` or `yarn.lock` to confirm the resolved version","fix":"- `cordova-plugin-advanced-http`: move to a version later than `3.3.1` (the advisory's patch link is on GitHub; the exact fixed version is unknown from the sources)","status":"open","published_at":"2026-11-03T16:17:27+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:23:47+00:00","updated_at":"2026-11-03T16:23:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T16:23:47Z","model":"claude-haiku-5-5","output":{"fix":"- `cordova-plugin-advanced-http`: move to a version later than `3.3.1` (the advisory's patch link is on GitHub; the exact fixed version is unknown from the sources)","reach":"network","title":"cordova-plugin-advanced-http: redirects leak session cookies to third-party hosts","impact":"medium","summary":"cordova-plugin-advanced-http versions 1.5.0 through 3.3.1 forward Cookie headers to other hosts when a request is redirected. An attacker who controls or influences a redirect can capture the user's cookies and hijack their sessions.","audience":"developers","category":"package","nicknames":[],"who_cares":["cordova","ios","android","mobile","session-hijack"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker captures session cookies and hijacks user sessions","analyst_note":"Confirm the fixed version from the GitHub patch link and the VulnCheck advisory; sources do not name it.","how_to_check":"- Check the installed version in the project's `package.json` or `config.xml` for `cordova-plugin-advanced-http` between `1.5.0` and `3.3.1`\n- Look for `cordova-plugin-advanced-http` in `package-lock.json` or `yarn.lock` to confirm the resolved version","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-cookie-requests"],"who_is_affected":"Apps built with Cordova that use cordova-plugin-advanced-http for network requests on iOS or Android, where the app's requests can be redirected to another host. The JavaScript layer passes cookies as normal headers, so native stacks follow redirects and send them along. Apps that do not use this plugin, or that make no cookie-bearing requests, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4212,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121554':17A,20A '-2026':16A,19A '1.5.0':35B,72C '3.3.1':37B,74C 'advanc':4A,32B,70C 'android':21B,121C 'anoth':108C 'attack':50B,115C,128C 'attacker-influenc':114C 'built':95C 'captur':58B 'contain':75C 'control':52B 'cooki':9A,39B,62B,82C,96C,125C 'cordova':2A,22B,30B,68C 'cordova-plugin-advanced-http':1A,29B,67C 'cve':15A,18A 'disclosur':78C 'forward':38B,123C 'header':40B,97C,101C,126C 'hijack':28B,64B,129C 'host':14A,43B,87C,109C 'http':5A,33B,71C 'influenc':54B,116C 'inform':77C 'io':23B,119C 'jar':94C 'jar-built':93C 'javascript':90C 'layer':91C 'leak':7A,81C 'let':127C 'mobil':24B 'nativ':118C 'open':112C 'ordinari':99C 'packag':25B 'parti':13A,86C 'pass':92C 'plugin':3A,31B,69C 'redirect':6A,48B,56B,106C,117C 'request':46B,100C,104C 'session':8A,27B,66B,131C 'session-hijack':26B 'stack':122C 'third':12A,85C 'third-parti':11A,84C 'user':60B,130C 'version':34B 'via':110C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Apps built with Cordova that use cordova-plugin-advanced-http for network requests on iOS or Android, where the app's requests can be redirected to another host. The JavaScript layer passes cookies as normal headers, so native stacks follow redirects and send them along. Apps that do not use this plugin, or that make no cookie-bearing requests, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","cordova","high","ios","mobile","package","sessionhijack"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121554","severity":null,"published_at":"2026-11-03T16:17:27+00:00","modified_at":"2026-11-03T16:17:27+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58843,"url":"https://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58844,"url":"https://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}