{"affected":[{"package":{"ecosystem":"Hex","name":"hackney","purl":"pkg:hex/hackney"},"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"4.9.0"}],"type":"SEMVER"}],"versions":["2.0.0","2.0.1","3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","4.0.0","4.0.1","4.0.2","4.0.3","4.1.0","4.2.0","4.2.1","4.2.2","4.2.3","4.3.0","4.4.0","4.4.1","4.4.2","4.4.3","4.4.5","4.5.0","4.5.1","4.5.2","4.6.0","4.6.1","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7"]},{"ranges":[{"events":[{"introduced":"8f944559bdb83da60b5c06f6cf6d842591278364"},{"fixed":"6548384b22ea196023a1963e2967d5715b6d9564"}],"repo":"https://github.com/benoitc/hackney","type":"GIT"}]}],"aliases":["CVE-2026-113440"],"credits":[{"name":"Martin Karrer","type":"FINDER"},{"name":"Martin Karrer","type":"REMEDIATION_DEVELOPER"},{"name":"Benoit Chesneau","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}],"database_specific":{"capec_ids":["CAPEC-102"],"cpe_ids":["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-522"]},"details":"## Summary\n\nInsufficiently Protected Credentials vulnerability in `hackney` in benoitc hackney allows a redirecting server to obtain the `basic_auth` and `cookie` credentials of a request via a same-host redirect to another scheme or port. With `follow_redirect` enabled, `hackney:follow_redirect/10` in `src/hackney.erl` reissues the request to the `Location` target after `hackney:maybe_strip_auth_on_redirect/3`, which compared only the hostname of the current and the redirect URL. A redirect from `https` to `http` on the same host resent the `Authorization` and `Cookie` headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. `location_trusted` forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0.\n\n## Details\n\n**1. Redirect handling.** With `follow_redirect` set, `hackney:request/5` hands a 3xx response to `hackney:follow_redirect/10` in `src/hackney.erl`, which resolves the `Location` header against the current URL and calls `hackney:request/5` again with the caller's options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n**2. Host-only comparison.** Before the new request, `hackney:maybe_strip_auth_on_redirect/3` removes the `basic_auth` and `cookie` options when the redirect leaves the current host, unless `location_trusted` is set. It compared `#hackney_url.host` of the two URLs.\n\n**3. Consequence.** A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same `Authorization` and `Cookie` headers. From `https` to `http` they travel in cleartext; to another port they reach a different service on the same host.\n\n## Impact\n\nA server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client's `Authorization` and `Cookie` headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin.\n\n## Workarounds\n\nDisable `follow_redirect` and handle the `Location` header in the application, or pass the credentials as explicit `Authorization` and `Cookie` request headers instead of the `basic_auth` and `cookie` options. `hackney:follow_redirect/10` issues the redirected request with an empty header list, so explicit headers reach the first server only.\n\n## Configurations\n\nThe request is made with `follow_redirect` enabled and the `basic_auth` or `cookie` option set, over HTTP/1.1 or HTTP/2, without `location_trusted`. Credentials passed as explicit request headers are not forwarded on redirects and are not affected.","id":"EEF-CVE-2026-113440","modified":"2026-10-26T13:49:18.181082Z","published":"2026-10-26T13:49:17.377Z","references":[{"type":"WEB","url":"https://github.com/benoitc/hackney/pull/979"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-113440.html"},{"type":"ADVISORY","url":"https://github.com/benoitc/hackney/releases/tag/4.9.0"},{"type":"WEB","url":"https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"},{"type":"FIX","url":"https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"},{"type":"PACKAGE","url":"https://hex.pm/packages/hackney"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","type":"CVSS_V4"}],"summary":"HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney","upstream":[]}