Executive brief
Hackney, a popular HTTP client library for Erlang, contains a security flaw in its HTTP/3 implementation. When the library is configured to follow redirects, it may inadvertently send sensitive information—such as login credentials, session cookies, and request data—to an untrusted third-party server if that server issues a redirect. This could allow an attacker to steal user sessions or private data by redirecting a legitimate request to a server they control.
Technical details
A vulnerability exists in the HTTP/3 redirect handler within `src/hackney_h3.erl` of the Hackney library. The `handle_redirect/11` function fails to verify if a redirect target's host matches the original request's origin before forwarding sensitive headers like `Authorization`, `Cookie`, and `Proxy-Authorization`. For 307 and 308 status codes, the original request body is also forwarded to the new destination. This occurs because the H3 client lacks the `maybe_strip_auth_on_redirect/2` logic present in the library's HTTP/1 implementation. Attackers can exploit this by providing a cross-origin `Location` header to capture credentials from clients with `follow_redirect` enabled. The issue is patched in version 4.0.1.
Affected products
- benoitc hackney >= 3.1.1, < 4.0.1
Timeline
- 2026-05-25: disclosed: Initial disclosure and NVD publication
- 2026-06-26: advisory: GitHub Advisory published/reviewed
- 2026-06-26: patched: Fix confirmed in version 4.0.1