Executive brief
Excon, a popular Ruby library used for making web requests, contains a flaw in how it handles website redirects. When a request is redirected to a new location, the library may accidentally send sensitive information, such as authentication tokens or cookies, to the new destination. This could allow an unauthorized third party to capture private credentials if they can trick the application into following a redirect to a server they control.
Technical details
A sensitive information leak (CWE-201) exists in Excon prior to version 1.5.0. The RedirectFollower middleware does not adequately redact sensitive HTTP headers (such as cookies and authorization tokens) when automatically following redirects to different hosts. An attacker who can influence the destination of a redirect could capture these headers, leading to credential theft or session hijacking. The fix in version 1.5.0 expands the list of redacted headers and removes the dangerous capture_cookies middleware.
Affected products
- excon excon < 1.5.0
Timeline
- 2026-06-03: patched: Fix merged into master branch
- 2026-07-17: advisory: CVE published to NVD