CVE-2026-49853

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.6

Description When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest and removes only the Host header. It fails to clear the Authorization header, auth username, auth password, or auth mode when the redirect target changes origin. Consequently, credentials intended for one origin may be forwarded to a different origin when follow redirects is set to True.

Recommendations Update to version 6.5.6 or later.