PT-2026-77168 · Python · Python
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Python (affected versions not specified)
Description
The
HTTPPasswordMgr class in the urllib.request module, including its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, fails to consider the URL scheme when matching stored credentials to a requested URL. This allows credentials intended for https:// to be sent over http:// if an attacker can redirect or downgrade the client connection, potentially leading to the capture of credentials in cleartext. Conversely, credentials for http:// could be sent over https://. Credential matching is now restricted by URL scheme, meaning credentials registered with a specific scheme are only used for requests using that same scheme, while those registered with a bare authority remain compatible with any scheme.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Ensure that applications do not make plain
http:// requests to hosts for which credentials are registered, such as by disabling the following of redirects to http:// URLs.Exploit
Insufficiently Protected Credentials
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Python