CVE-2022-21712

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

• CWE-200
• CWE-346

• https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2Patch, Third Party Advisory
• https://github.com/twisted/twisted/releases/tag/twisted-22.1.0Release Notes, Third Party Advisory
• https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvxThird Party Advisory
• https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2Patch, Third Party Advisory
• https://github.com/twisted/twisted/releases/tag/twisted-22.1.0Release Notes, Third Party Advisory
• https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvxThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/
• https://security.gentoo.org/glsa/202301-02

Published

Feb 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8
• CVE-2022-21707wasmCloud Host Runtime is a server process that securely hos…8.1
• CVE-2022-21708graphql-go is a GraphQL server with a focus on ease of use. …6.5
• CVE-2022-2171The Progressive License WordPress plugin through 1.1.0 is la…5.4
• CVE-2022-21710ShortDescription is a MediaWiki extension that provides loca…6.1
• CVE-2022-21711elfspirit is an ELF static analysis and injection framework …7.1
• CVE-2022-21713Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2022-21715CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…6.1
• CVE-2022-21716Twisted is an event-based framework for internet application…7.5
• CVE-2022-21718Electron is a framework for writing cross-platform desktop a…5
• CVE-2022-21719GLPI is a free asset and IT management software package. All…6.1
• CVE-2022-2172The LinkWorth WordPress plugin before 3.3.4 does not impleme…4.3