CVE-2026-113440

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow redirect enabled, hackney:follow redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe strip auth on redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location trusted forwards credentials to any target by design and is unchanged.

This issue affects hackney: from 2.0.0 before 4.9.0.

1. Redirect handling. With follow redirect set, hackney:request/5 hands a 3xx response to hackney:follow redirect/10 in src/hackney.erl, which resolves the Location header against the current URL and calls hackney:request/5 again with the caller's options and an empty header list. HTTP/1.1 and HTTP/2 share this path.

2. Host-only comparison. Before the new request, hackney:maybe strip auth on redirect/3 removes the basic auth and cookie options when the redirect leaves the current host, unless location trusted is set. It compared #hackney url.host of the two URLs.

3. Consequence. A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same Authorization and Cookie headers. From https to http they travel in cleartext; to another port they reach a different service on the same host.

A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client's Authorization and Cookie headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin.

Disable follow redirect and handle the Location header in the application, or pass the credentials as explicit Authorization and Cookie request headers instead of the basic auth and cookie options. hackney:follow redirect/10 issues the redirected request with an empty header list, so explicit headers reach the first server only.

The request is made with follow redirect enabled and the basic auth or cookie option set, over HTTP/1.1 or HTTP/2, without location trusted. Credentials passed as explicit request headers are not forwarded on redirects and are not affected.