Executive brief
AsyncHttpClient is a popular HTTP client library used in Java applications to make network requests. When configured with credentials at the application level and following redirects, the client could accidentally send authentication credentials (usernames, passwords, or tokens) to a malicious attacker-controlled website during a redirect. This allows an attacker to steal credentials intended for legitimate services.
Technical details
The vulnerability is a credential re-derivation flaw in AsyncHttpClient's redirect handling. When processing a cross-origin redirect after receiving a 401 response, the client was re-reading credentials from the client-wide realm configuration instead of from the per-request state that had already been cleared during the redirect. This occurs only when credentials are configured globally on the client builder rather than per-request, and only when following redirects. An attacker controlling a redirect target can capture Basic/Digest credentials or Negotiate/NTLM tokens by triggering a 401 response. The fix (3.0.12 and 2.16.1) reads the realm from the per-request response state instead of re-deriving it from client configuration.
Affected products
- AsyncHttpClient AsyncHttpClient 2.14.5 through 2.16.0, 3.0.9 through 3.0.11
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in 3.0.12 and 2.16.1