Is CVE-2026-91766 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91766 being exploited in the wild.

How severe is CVE-2026-91766?

Medium severity, with a CVSS score of 5.9, published 25 September 2026.

Which products and versions are affected?

Php < 8.2.34, < 8.3.35, < 8.4.26, < 8.5.11.

Is there a fix for CVE-2026-91766?

A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91766 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91766?

Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91766: PHP HTTP stream wrapper credential leak on cross-origin redirect

Q: Which products and versions are affected?

Php < 8.2.34, < 8.3.35, < 8.4.26, < 8.5.11.

Q: Is there a fix for CVE-2026-91766?

A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-91766 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-91766?

Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91766 · Severity: medium · CVSS 5.9 · Published 2026-09-25

PHP's HTTP stream wrapper, used for fetching remote content with authentication credentials, forwards Authorization, Cookie, and Proxy-Authorization headers across redirects even when the destination is a different host or port, or downgrades from HTTPS to HTTP. An attacker controlling a redirect target can intercept credentials intended for the original server, leading to account compromise or session hijacking.

Technologies: Php. Vendors: PHP.

Quick answers

Is CVE-2026-91766 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91766 being exploited in the wild.
How severe is CVE-2026-91766?: Medium severity, with a CVSS score of 5.9, published 25 September 2026.
Which products and versions are affected?: Php < 8.2.34, < 8.3.35, < 8.4.26, < 8.5.11.
Is there a fix for CVE-2026-91766?: A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91766 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91766?: Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The http:// stream wrapper in PHP's ext/standard module fails to strip authentication headers when following redirects to different origins (different scheme, host, or port). An unauthenticated network attacker can exploit this by controlling a redirect target or by compromising a legitimate service that redirects to a third party, receiving the victim's bearer tokens, session cookies, or proxy credentials. The vulnerability is fixed in patched versions by comparing the original request origin with the redirect target and stripping credential headers on cross-origin hops.

Affected products

PHP PHP < 8.2.34, < 8.3.35, < 8.4.26, < 8.5.11

Timeline

2026-09-25: disclosed
2026-09-25: patched: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11

References

https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.