CVE-2026-91766
Last modified
CVE-2026-91766 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin.
Description
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| PHP Group | PHP | >= 8.2.*, < 8.2.34; >= 8.3.*, < 8.3.35; >= 8.4.*, < 8.4.26; >= 8.5.*, < 8.5.11 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-91766?
How severe is CVE-2026-91766?
How do I fix CVE-2026-91766?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9175The Devs Accounting – Simple Accounting and Invoicing Soluti…5.3
- CVE-2026-91750WeKnora before 0.7.0 fails to re-validate HTTP redirect targ…6.5
- CVE-2026-91751Flextype CMS through 1.0.0-alpha.3 fails to properly validat…8.3
- CVE-2026-91752GNU libextractor before 1.15 contains a stack-based buffer o…7.5
- CVE-2026-9176IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.1
- CVE-2026-91765cleanup_xml_node() in the SOAP XML parser recurses once per …7.5
- CVE-2026-91767php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c …6.5
- CVE-2026-91769PHP's OpenSSL stream peer verification checks the certificat…4.3
- CVE-2026-9177A Server-Side Template Injection (SSTI) vulnerability was id…9.4
- CVE-2026-91770IceHRM before 36.0.0 fails to validate employee ownership on…6.5
- CVE-2026-91771Weights & Biases wandb before 0.29.0 fails to validate the f…8.8
- CVE-2026-91772Halo through 2.26.1 contains an open redirect vulnerability …6.1
Are you affected by CVE-2026-91766?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST