CVE-2026-59180

Name of the Vulnerable Software and Affected Versions Apprise versions prior to 1.11.0

Description HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default. During this process, user-configured authentication headers and query parameters are resent on the redirected request. This behavior allows an on-path attacker or a compromised trusted destination to intercept sensitive information, including Authorization headers, bearer tokens, custom headers, and service keys.

Recommendations Update to version 1.11.0.