Executive brief
AIOHTTP is a popular Python library used by developers to build web servers and clients. A security flaw in the library's client component causes sensitive session cookies to be sent to unintended third-party websites during a redirect. If an attacker can trick an application into following a redirect to a malicious server, they could steal authentication tokens or other private user data.
Technical details
AIOHTTP fails to properly validate the origin before forwarding cookies during an HTTP redirect. When a request is initiated using the 'cookies' parameter, the library persists these cookies even if the server responds with a redirect to a different domain (cross-origin). An attacker who can control the destination of a redirect can capture these cookies, which may contain sensitive session identifiers or authentication tokens. This issue is rooted in the client-side request handling logic within 'aiohttp/client.py'. The vulnerability is addressed in version 3.14.0 by ensuring per-request cookies are dropped upon cross-origin redirection.
Affected products
- aio-libs aiohttp < 3.14.0
Timeline
- 2026-06-02: disclosed
- 2026-06-02: patched
- 2026-06-03: advisory