CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.

• CWE-201

• https://github.com/Orange-OpenSource/hurl/commit/ed91c894c2cf11704422010554037e3ba70b446e
• https://github.com/Orange-OpenSource/hurl/pull/5119
• https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.1
• https://github.com/Orange-OpenSource/hurl/security/advisories/GHSA-7w2g-9mf9-324m

Published

Aug 20, 2026

Last Modified

Oct 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63471fastapi-code-generator creates FastAPI applications from Ope…9.3
• CVE-2026-63472Vendure is an open-source headless commerce platform. Prior …9.1
• CVE-2026-63475isomorphic-git is a pure JavaScript implementation of Git fo…4.3
• CVE-2026-63476isomorphic-git is a pure JavaScript implementation of Git fo…4.3
• CVE-2026-63478isomorphic-git is a pure JavaScript implementation of Git fo…5.3
• CVE-2026-6348WinMatrix agent developed by Simopro Technology has a Missin…8.8
• CVE-2026-63482Yeti bridges the gap between CTI and DFIR practitioners by p…7.5
• CVE-2026-63489Yeti bridges the gap between CTI and DFIR practitioners by p…7.6
• CVE-2026-6349The  iSherlock developed by HGiga  has an OS Command Injecti…9.8
• CVE-2026-63490Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-63492Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63493Snipe-IT is an IT asset/license management system. Prior to …8.1