CVE-2023-30846

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds.

• CWE-522

• https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8Patch
• https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmqVendor Advisory
• https://security.netapp.com/advisory/ntap-20230601-0008/
• https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8Patch
• https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmqVendor Advisory
• https://security.netapp.com/advisory/ntap-20230601-0008/

Published

Apr 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30840Fluid is an open source Kubernetes-native distributed datase…7.8
• CVE-2023-30841Baremetal Operator (BMO) is a bare metal host provisioning i…5.5
• CVE-2023-30842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-30843Payload is a free and open source headless content managemen…6.5
• CVE-2023-30844Mutagen provides real-time file synchronization and flexible…8.8
• CVE-2023-30845ESPv2 is a service proxy that provides API management capabi…9.8
• CVE-2023-30847H2O is an HTTP server. In versions 2.3.0-beta2 and prior, wh…8.2
• CVE-2023-30848Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30849Pimcore is an open source data and experience management pla…8.8
• CVE-2023-3085A vulnerability, which was classified as problematic, has be…6.1
• CVE-2023-30850Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30851Cilium is a networking, observability, and security solution…5.3