Authorization Header Handling Vulnerability in Hurl Command Line Tool by Orange Open Source
CVE-2026-63481

6.9MEDIUM

Key Information:

Vendor: Orange-opensource
Status: Hurl
Vendor: CVE Published:; 20 August 2026

🔔 Create Orange-opensource Vulnerability Alert

What is CVE-2026-63481?

A flaw in Hurl, a command line tool for HTTP request management, allows for unauthorized access via mishandled redirect scenarios. Specifically, versions 8.0.1 and earlier do not adequately handle the Authorization and Cookie headers during redirects that modify the host. While session cookies from the dedicated [Cookies] section may be included in the redirected request, raw Cookie headers are stripped, creating a potential security risk. This issue has been addressed in version 8.1.0.