CVE-2026-47265

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

• CWE-346

• https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pgMitigation, Patch, Vendor Advisory

Published

Jun 2, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4726Denial-of-service in the XML component. This vulnerability w…7.5
• CVE-2026-47260Koel is a free, open-source music streaming solution. Prior …7.7
• CVE-2026-47261Wasmtime is a runtime for WebAssembly. In versions prior to …7.5
• CVE-2026-47262containerd is an open-source container runtime. Versions pri…5.5
• CVE-2026-47263Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-47264Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-47266Formie is a Craft CMS plugin for creating forms. Prior to 2.…8.7
• CVE-2026-47267Gogs is an open source self-hosted Git service. Prior to 0.1…8.3
• CVE-2026-47268Nezha Monitoring is a self-hostable, lightweight, servers an…6.4
• CVE-2026-47269pam_usb provides hardware authentication for Linux using ord…7.4
• CVE-2026-4727Denial-of-service in the Libraries component in NSS. This vu…7.5
• CVE-2026-47270pam_usb provides hardware authentication for Linux using ord…6.3