Most recent entries from all

CVE-2026-44503 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

2026-09-29T17:58:54.789313+00:00

Affected: microsoft kiota-java, Microsoft.Kiota.Abstractions, microsoft github.com/microsoft/kiota-http-go, microsoft kiota-typescript, microsoft-kiota-abstractions, microsoft-kiota-http

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

GHSA-7j59-v9qr-6fq9 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

2026-09-29T17:58:54.789419+00:00

Affected: Maven: com.microsoft.kiota:microsoft-kiota-abstractions, NuGet: Microsoft.Kiota.Abstractions, PyPI: microsoft-kiota-http, npm: kiota-typescript, Go: github.com/microsoft/kiota-http-go

### Summary The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

### Details Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

``` boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme()); boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString()); if (!sameScheme || !sameHost) { requestBuilder.removeHeader("Authorization"); // BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed } ```

### PoC 1. Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota…

PYSEC-2026-2647 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

2026-09-29T17:58:54.789507+00:00

Affected: PyPI: microsoft-kiota-http

This vulnerability is present in the RedirectHandlers for:

### Details Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

### PoC 1. Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota…