CVE-2026-107715

Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.14.1

Description Mechanize leaks caller-supplied credential headers to a different host during an HTTP redirect. This occurs because Mechanize#request headers= is reapplied by Mechanize::HTTP::Agent#request add headers even after Mechanize::HTTP::Agent#response redirect strips per-request headers. Additionally, the protected header lists omit Proxy-Authorization and Cookie2. An attacker controlling a redirect target can capture bearer tokens or session cookies supplied through request headers= or the per-request headers argument. This issue is limited to headers set manually by the caller; cookies in Mechanize#cookie jar and credentials in Mechanize::HTTP::AuthStore are not affected.

Recommendations Update to version 2.14.1. As a temporary workaround, set Mechanize#redirect ok to false and handle redirects explicitly. Avoid using request headers= for credentials and instead pass them per-request only to trusted hosts.