# CVE-2026-40490: AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

Source: https://junglewise.ai/threats/cve-2026-40490-asynchttpclient-leaks-authorization-credentials-to-untrusted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40490 · Severity: medium · CVSS 6.8 · Published 2026-04-14

### Impact
When redirect following is enabled (followRedirect(true)), AsyncHttpClient forwards Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades.

Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory.

An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value.

### Patches
Fixed in version 3.0.9 or 2.14.5. Users should upgrade immediately.

The fix automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP.

### Workarounds
For users unable to upgrade, set (stripAuthorizationOnRedirect(true)) in the client config and avoid using Realm-based authentication with redirect following enabled. Note that (stripAuthorizationOnRedirect(true)) alone is insufficient on versions prior to 3.0.9 or 2.14.5 because the Realm bypass still re-generates credentials.

Alternatively, disable redirect following (followRedirect(false)) and handle redirects manually with origin validation.

### References
 - Fix commit: https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8

Technologies: [org.asynchttpclient:async-http-client (Maven)](https://junglewise.ai/threats/technologies/org-asynchttpclient-async-http-client). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-40490 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40490 being exploited in the wild.

**How severe is CVE-2026-40490?** Medium severity, with a CVSS score of 6.8, published 14 April 2026.

**Which products and versions are affected?** org.asynchttpclient:async-http-client (Maven) ECOSYSTEM:introduced=3.0.0.Beta1,fixed=3.0.9.

**Is there a fix for CVE-2026-40490?** Yes. org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40490?** Check whether you run org.asynchttpclient:async-http-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.asynchttpclient:async-http-client (Maven): upgrade to 3.0.9 or later

  ```sh
  # set org.asynchttpclient:async-http-client to 3.0.9 in your pom.xml or build.gradle
  ```


## Affected products

- org.asynchttpclient:async-http-client (Maven) ECOSYSTEM:introduced=3.0.0.Beta1,fixed=3.0.9

## Identifiers

- CVE-2026-40490
- GHSA-cmxv-58fp-fm3g

## References

- [https://api.github.com/users/hyperxpro](https://api.github.com/users/hyperxpro)
- [https://github.com/hyperxpro](https://github.com/hyperxpro)
- [https://api.github.com/users/hyperxpro/gists%7B/gist_id%7D](https://api.github.com/users/hyperxpro/gists%7B/gist_id%7D)
- [https://api.github.com/users/hyperxpro/repos](https://api.github.com/users/hyperxpro/repos)
- [https://avatars.githubusercontent.com/u/24762260?v=4](https://avatars.githubusercontent.com/u/24762260?v=4)
- [https://api.github.com/users/hyperxpro/events%7B/privacy%7D](https://api.github.com/users/hyperxpro/events%7B/privacy%7D)

## Related threats

- [AsyncHttpClient credentials exposure in plaintext CONNECT proxy requests](https://junglewise.ai/threats/cve-2026-85720-asynchttpclient-credentials-exposure-in-plaintext-connect-proxy)
- [AsyncHttpClient SCRAM and Digest mutual authentication verification bypass](https://junglewise.ai/threats/cve-2026-85716-asynchttpclient-scram-and-digest-mutual-authentication)
- [AsyncHttpClient unbounded HTTP/1.1 response decompression denial of service](https://junglewise.ai/threats/cve-2026-85721-asynchttpclient-unbounded-http-1-1-response-decompression-denial)
- [AsyncHttpClient credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-85717-asynchttpclient-credential-leak-on-cross-origin-redirect)
- [AsyncHttpClient cookie injection in ThreadSafeCookieStore](https://junglewise.ai/threats/cve-2026-55688-asynchttpclient-cookie-injection-in-threadsafecookiestore)