CVE-2026-113440

Name of the Vulnerable Software and Affected Versions hackney versions 2.0.0 through 4.8.9

Description An issue exists where a redirecting server can obtain basic auth and cookie credentials through a same-host redirect to a different scheme or port. When follow redirect is enabled, the function hackney:follow redirect/10 in src/hackney.erl re-issues requests to the Location target. The check performed by hackney:maybe strip auth on redirect/3 only compares the hostname of the current and redirect URLs. Consequently, a redirect from https to http on the same host sends the Authorization and Cookie headers in cleartext, allowing an on-path attacker to intercept them. Similarly, a redirect to a different port on the same host sends these credentials to a different service. This occurs over HTTP/1.1 and HTTP/2 when location trusted is not set.

Recommendations Update hackney to version 4.9.0 or later. Disable follow redirect and handle the Location header within the application. Pass credentials as explicit Authorization and Cookie request headers instead of using the basic auth and cookie options.