Insufficiently Protected Credentials in Hackney by Benoitc

CVE-2026-113440

What is CVE-2026-113440?

The vulnerability in Hackney allows an attack scenario where a malicious redirecting server can exploit insufficiently protected credentials. Specifically, when follow_redirect is enabled, Hackney can inadvertently reissue requests to a new Location that uses a different scheme or port on the same host. This can lead to sensitive information such as Authorization and Cookie headers being sent in cleartext. An attacker with network access can intercept these headers, compromising user credentials and potentially exposing them to unauthorized services. It is essential to note that this behavior persists in the design of the location_trusted function, which forwards credentials without alteration.

References