CVE-2026-113440: HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

Vulnerability summary

CVE-2026-113440 is a medium (CVSS 6.0) Insufficiently Protected Credentials vulnerability in benoitc hackney. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24.2% of scored vulnerabilities.

Timeline

1. 26-10-2026
   PublishedVulnerability first disclosed.
2. 02-11-2026
   Last modifiedVulnerability information updated.

Description

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.