Executive brief
Apprise is a notification library used by developers to send alerts to various services like Slack, Discord, and email. A security flaw was found where the library would automatically follow web redirects and resend sensitive login information (like passwords or secret tokens) to the new, potentially malicious destination. This could allow an attacker to steal credentials if they can trick the system into following a link to a server they control.
Technical details
Apprise versions prior to 1.11.0 contain an information disclosure vulnerability in its HTTP-based notification plugins and attachment/config loaders (specifically in apprise/attachment/http.py and apprise/config/http.py). The library follows HTTP 3xx redirects by default and fails to strip user-configured sensitive headers, such as Authorization or bearer tokens, when performing the redirected request. An attacker who controls a trusted destination or is positioned on-path could trigger a redirect to a malicious server to capture these secrets. The fix in version 1.11.0 introduces a 'redirect' parameter to control this behavior and mitigates the automatic forwarding of sensitive credentials across origins.
Affected products
- caronc Apprise < 1.11.0
Timeline
- 2026-05-16: patched: Fix committed to master branch
- 2026-05-29: advisory: Release v1.11.0 published
- 2026-07-10: disclosed: CVE-2026-59180 published