CVE-2026-40895

Name of the Vulnerable Software and Affected Versions follow-redirects versions prior to 1.16.0

Description When an HTTP request follows a cross-domain redirect (301, 302, 307, or 308), the software only removes authorization, proxy-authorization, and cookie headers. Any custom authentication headers, such as X-API-Key, X-Auth-Token, Api-Key, or Token, are forwarded verbatim to the redirect target.

Recommendations Update to version 1.16.0.