CVE-2026-54276: AIOHTTP information exposure in DigestAuthMiddleware cross-origin redirects

CVE-2026-54276 · Severity: medium · CVSS 4 · Published 2026-06-22

AIOHTTP is a popular Python library used by developers to build web servers and clients. A security flaw in its authentication component could allow an attacker to trick the library into sending sensitive login information to a malicious website. This typically occurs if the application follows a link that redirects to an attacker-controlled server, potentially leading to the theft of user credentials.

Technologies: aiohttp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54276 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54276 being exploited in the wild.
How severe is CVE-2026-54276?
Medium severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
aiohttp (PyPI) <= 3.14.0, ECOSYSTEM:introduced=0,fixed=3.14.1.
Is there a fix for CVE-2026-54276?
Yes. aiohttp (PyPI): upgrade to 3.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54276 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54276?
Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • aiohttp (PyPI): upgrade to 3.14.1 or later
    pip install "aiohttp>=3.14.1"

Technical details

A vulnerability exists in AIOHTTP's DigestAuthMiddleware where authentication credentials are not strictly scoped to the original request's origin. When the client follows a cross-origin redirect, the middleware may respond to a digest authentication challenge from the new, potentially malicious origin using the original credentials. An attacker could exploit this by leveraging an open redirect on a trusted site to capture the user's authentication digest. While the attacker only receives the digest rather than the plaintext password, they may be able to crack it if weak cryptography is used or if the user reuses passwords. The issue is fixed in version 3.14.1 by scoping credentials to the initial request origin.

Affected products

  • aio-libs aiohttp < 3.14.1

Identifiers

  • CVE-2026-54276
  • GHSA-hpj7-wq8m-9hgp
  • PYSEC-2026-2109

Timeline

  • 2026-06-07: patched: Fix committed to repository
  • 2026-06-08: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.