CVE-2026-15806

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description The HTTPPasswordMgr class in the urllib.request module, including its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, fails to consider the URL scheme when matching stored credentials to a requested URL. This allows credentials intended for https:// to be sent over http:// if an attacker can redirect or downgrade the client connection, potentially leading to the capture of credentials in cleartext. Conversely, credentials for http:// could be sent over https://. Credential matching is now restricted by URL scheme, meaning credentials registered with a specific scheme are only used for requests using that same scheme, while those registered with a bare authority remain compatible with any scheme.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Ensure that applications do not make plain http:// requests to hosts for which credentials are registered, such as by disabling the following of redirects to http:// URLs.