https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:19:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-8368 <p><strong>Affected:</strong> OALDERS LWP::UserAgent</p> <p>LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.</p> <p>On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.</p> <p>A redirect to an attacker controlled host therefore discloses the caller&#39;s credentials to that host.</p> <p><strong>Affected:</strong> OALDERS LWP::UserAgent</p> <p>LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.</p> <p>On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.</p> <p>A redirect to an attacker controlled host therefore discloses the caller&#39;s credentials to that host.</p> https://vulnerability.circl.lu/vuln/cve-2026-8368