Credential Leakage Vulnerability in Tesla by Elixir

CVE-2026-48595

What is CVE-2026-48595?

The Elixir Tesla library exhibits a vulnerability due to improper handling of case sensitivity in HTTP headers during cross-origin redirects. The middleware responsible for handling redirects strips security-sensitive headers, like 'Authorization', based on a case-sensitive comparison against a list of lowercase filter entries. This design flaw results in the potential leakage of sensitive information, such as bearer tokens, when headers are not normalized to the correct case as per HTTP specifications. An attacker capable of influencing a redirect may exploit this flaw to gain unauthorized access to sensitive credentials.

References