Executive brief
Tornado, a popular Python web framework and networking library, contained a flaw in how it handled web redirects. When a program using Tornado's HTTP client was redirected to a different website, it would mistakenly send the original site's login credentials and cookies to the new, potentially malicious destination. This could allow an attacker to steal sensitive authentication tokens or user session data by tricking a service into following a redirect to a server they control.
Technical details
A vulnerability exists in Tornado's SimpleAsyncHTTPClient where redirected requests are shallow-copied without properly clearing sensitive headers. Specifically, when a 3xx redirect changes the scheme, host, or port (cross-origin), the client removes the 'Host' header but retains 'Authorization', 'Cookie', 'auth_username', 'auth_password', and 'auth_mode'. An attacker who can influence a URL requested by a Tornado-based application could redirect the client to a malicious server to capture these credentials. This issue is fixed in version 6.5.6, which now strips these headers on cross-origin redirects to match libcurl's behavior.
Affected products
- tornadoweb tornado < 6.5.6
Timeline
- 2026-05-27: patched: Fixed in version 6.5.6
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-14: disclosed: CVE published to NVD