# CVE-2026-69212: Http4s FollowRedirect credential leak on scheme downgrade

Source: https://junglewise.ai/threats/cve-2026-69212-http4s-followredirect-credential-leak-on-scheme-downgrade  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-69212 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Http4s is a Scala-based HTTP client library widely used to build microservices and API clients. The FollowRedirect middleware, which automatically follows HTTP redirects, fails to strip authentication and session cookies when redirects downgrade from HTTPS to HTTP on the same domain. An attacker who can force a redirect and monitor network traffic can capture these credentials in plaintext, potentially compromising API keys, session tokens, and user accounts.

Technologies: [Http4s](https://junglewise.ai/threats/technologies/http4s). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s).

## Quick answers

**Is CVE-2026-69212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69212 being exploited in the wild.

**How severe is CVE-2026-69212?** Medium severity, with a CVSS score of 5.9, published 15 September 2026.

**Which products and versions are affected?** Http4s prior to 0.23.35 and 1.0.0-M47.

**Is there a fix for CVE-2026-69212?** A patch was published on 2026-07-06: Fix released in versions 0.23.35 and 1.0.0-M47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69212 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-69212?** Check whether you run Http4s at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The FollowRedirect middleware in Http4s compares HTTP authority (hostname + port) between pre-redirect and post-redirect URLs to determine whether to strip sensitive headers like Authorization and Cookie. However, the comparison logic excludes the URI scheme (protocol), meaning a same-authority redirect from https://example.com to http://example.com is incorrectly treated as safe. Credentials are preserved and transmitted over plaintext HTTP. The vulnerability requires network-adjacent attacker position to observe traffic (e.g., compromised network, DNS hijacking, or MITM on redirect), or ability to induce the downgrade. Applications using FollowRedirect for any outbound HTTP client calls are affected. Fixes are available in versions 0.23.35 and 1.0.0-M47.

## Affected products

- Http4s Http4s prior to 0.23.35 and 1.0.0-M47

## Timeline

- 2026-09-15: disclosed
- 2026-07-06: patched: Fix released in versions 0.23.35 and 1.0.0-M47

## References

- [https://github.com/http4s/http4s/commit/6e825719b8d2f1538f2c49089c2dc81321a833b4](https://github.com/http4s/http4s/commit/6e825719b8d2f1538f2c49089c2dc81321a833b4)
- [https://github.com/http4s/http4s/releases/tag/v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)

## Related threats

- [Http4s Ember HTTP/1.1 parser request smuggling via duplicate Content-Length](https://junglewise.ai/threats/cve-2026-69217-http4s-ember-http-1-1-parser-request-smuggling-via-duplicate)
- [Http4s WebSocket decoder negative length handling denial of service](https://junglewise.ai/threats/cve-2026-69210-http4s-websocket-decoder-negative-length-handling-denial-of)
- [Http4s DigestAuth replay attack in authorization header](https://junglewise.ai/threats/cve-2026-69206-http4s-digestauth-replay-attack-in-authorization-header)
- [Http4s ResponseCookie header injection via unescaped attributes](https://junglewise.ai/threats/cve-2026-69211-http4s-responsecookie-header-injection-via-unescaped-attributes)
- [Http4s ResourceService and WebjarService path traversal via percent-encoded separators](https://junglewise.ai/threats/cve-2026-69201-http4s-resourceservice-and-webjarservice-path-traversal-via)