Junglewise Threat Intelligence

CVE-2026-47265: AIOHTTP sensitive cookie leak during cross-origin redirect

CVE-2026-47265 · Severity: medium · CVSS 4 · Published 2026-06-02

Technologies: aiohttp (PyPI). Vendors: PyPI.

Executive brief

AIOHTTP is a popular Python library used by developers to build web servers and clients. A security flaw in the library's client component causes sensitive session cookies to be sent to unintended third-party websites during a redirect. If an attacker can trick an application into following a redirect to a malicious server, they could steal authentication tokens or other private user data.

Technical details

AIOHTTP fails to properly validate the origin before forwarding cookies during an HTTP redirect. When a request is initiated using the 'cookies' parameter, the library persists these cookies even if the server responds with a redirect to a different domain (cross-origin). An attacker who can control the destination of a redirect can capture these cookies, which may contain sensitive session identifiers or authentication tokens. This issue is rooted in the client-side request handling logic within 'aiohttp/client.py'. The vulnerability is addressed in version 3.14.0 by ensuring per-request cookies are dropped upon cross-origin redirection.

Affected products

  • aio-libs aiohttp < 3.14.0

Timeline

  • 2026-06-02: disclosed
  • 2026-06-02: patched
  • 2026-06-03: advisory

References

Related threats