CVE-2026-107714: Mechanize sends credential headers to a different scheme or port after a redirect

Vulnerability summary

CVE-2026-107714 is a medium (CVSS 5.9) vulnerability in sparklemotion mechanize. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.8% of scored vulnerabilities.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.