CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.

• CWE-200
• CWE-601

• https://github.com/caronc/apprise/commit/68c0aef218055e4586cf4605fd6b56358f5f462d
• https://github.com/caronc/apprise/pull/1610
• https://github.com/caronc/apprise/releases/tag/v1.11.0
• https://github.com/caronc/apprise/security/advisories/GHSA-856c-92hv-3vxx
• https://github.com/caronc/apprise/security/advisories/GHSA-856c-92hv-3vxx

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59155Nezha Monitoring is a self-hostable, lightweight, servers an…6.9
• CVE-2026-59161Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59162Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-5917libgit2 versions v0.27.0 through v1.9.0 built with the libss…9.6
• CVE-2026-59173Uncontrolled Resource Consumption vulnerability in Apache Tr…7.5
• CVE-2026-5918Inappropriate implementation in Navigation in Google Chrome …4.3
• CVE-2026-5919Insufficient validation of untrusted input in WebSockets in …6.5
• CVE-2026-59190grav-plugin-admin is an HTML user interface that provides a …8.7
• CVE-2026-59193Grav is a file-based Web platform. Prior to 2.0.0, an authen…4.9
• CVE-2026-59194pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a cr…7.1
• CVE-2026-59195pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm…8.2
• CVE-2026-59196pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a cr…7.1