CVE-2020-11021

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

• CWE-200

• https://github.com/actions/http-client/commit/f6aae3dda4f4c9dc0b49737b36007330f78fd53aPatch, Third Party Advisory
• https://github.com/actions/http-client/pull/27Patch, Third Party Advisory
• https://github.com/actions/http-client/security/advisories/GHSA-9w6v-m7wp-jwg4Third Party Advisory
• https://github.com/actions/http-client/commit/f6aae3dda4f4c9dc0b49737b36007330f78fd53aPatch, Third Party Advisory
• https://github.com/actions/http-client/pull/27Patch, Third Party Advisory
• https://github.com/actions/http-client/security/advisories/GHSA-9w6v-m7wp-jwg4Third Party Advisory

Published

Apr 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11016IntelMQ Manager from version 1.1.0 and before version 2.1.1 …8.8
• CVE-2020-11017In FreeRDP less than or equal to 2.0.0, by providing manipul…6.5
• CVE-2020-11018In FreeRDP less than or equal to 2.0.0, a possible resource …6.5
• CVE-2020-11019In FreeRDP less than or equal to 2.0.0, when running with lo…6.5
• CVE-2020-1102A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-11020Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1…9.8
• CVE-2020-11022In jQuery starting with 1.12.0 and before 3.5.0, passing HTM…6.1
• CVE-2020-11023In jQuery versions greater than or equal to 1.0.3 and before…6.1
• CVE-2020-11024In Moonlight iOS/tvOS before 4.0.1, the pairing process is v…8.2
• CVE-2020-11025In affected versions of WordPress, a cross-site scripting (X…5.4
• CVE-2020-11026In affected versions of WordPress, files with a specially cr…5.4
• CVE-2020-11027In affected versions of WordPress, a password reset link ema…8.1