# CVE-2026-91766: PHP HTTP stream wrapper credential leak on cross-origin redirect

Source: https://junglewise.ai/threats/cve-2026-91766-when-the-http-stream-wrapper-follows-a-redirect-it-forwards-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91766 · Severity: medium · CVSS 5.9 · Published 2026-09-25

PHP's HTTP stream wrapper, used for fetching remote content with authentication credentials, forwards Authorization, Cookie, and Proxy-Authorization headers across redirects even when the destination is a different host or port, or downgrades from HTTPS to HTTP. An attacker controlling a redirect target can intercept credentials intended for the original server, leading to account compromise or session hijacking.

Technologies: [Php](https://junglewise.ai/threats/technologies/php-php). Vendors: [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2026-91766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91766 being exploited in the wild.

**How severe is CVE-2026-91766?** Medium severity, with a CVSS score of 5.9, published 25 September 2026.

**Which products and versions are affected?** Php < 8.2.34, < 8.3.35, < 8.4.26, < 8.5.11.

**Is there a fix for CVE-2026-91766?** A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91766 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-91766?** Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The http:// stream wrapper in PHP's ext/standard module fails to strip authentication headers when following redirects to different origins (different scheme, host, or port). An unauthenticated network attacker can exploit this by controlling a redirect target or by compromising a legitimate service that redirects to a third party, receiving the victim's bearer tokens, session cookies, or proxy credentials. The vulnerability is fixed in patched versions by comparing the original request origin with the redirect target and stripping credential headers on cross-origin hops.

## Affected products

- PHP PHP < 8.2.34, < 8.3.35, < 8.4.26, < 8.5.11

## Timeline

- 2026-09-25: disclosed
- 2026-09-25: patched: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11

## References

- [https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92](https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92)

## Related threats

- [PHP stream filter heap information leak with NUL bytes in line-break-chars](https://junglewise.ai/threats/cve-2026-92842-the-convert-base64-encode-convert-quoted-printable-encode-and)
- [PHP OpenSSL stream peer verification certificate validation bypass](https://junglewise.ai/threats/cve-2026-91769-php-s-openssl-stream-peer-verification-checks-the-certificate-s)
- [PHP OpenSSL heap-buffer overflow in wildcard certificate name matching](https://junglewise.ai/threats/cve-2026-91767-php-openssl-matches-wildcard-name-in-ext-openssl-xp-ssl-c)
- [PHP SOAP XML parser unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-91765-cleanup-xml-node-in-the-soap-xml-parser-recurses-once-per-xml)
- [PHP Phar TAR integer overflow in size parsing](https://junglewise.ai/threats/cve-2026-6103-phar-tar-number-parses-the-octal-size-field-of-a-tar-header-into-a)