CVE-2026-54276

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.1

Description DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. If a client follows a redirect to an attacker-controlled domain, the attacker may be able to extract the authentication digest. This scenario likely requires an open redirect or a similar issue on the target domain. The attacker would only receive the digest, meaning credentials could only be extracted if the cryptography is weak or if password reuse occurs.

Recommendations Update to version 3.14.1. As a temporary workaround, disable follow redirects.