CVE-2026-91766
Last modified
CVE-2026-91766 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 8.2.0, < 8.2.34 |
| Php | Php | >= 8.3.0, < 8.3.35 |
| Php | Php | >= 8.4.0, < 8.4.26 |
| Php | Php | >= 8.5.0, < 8.5.11 |
References
- https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92Vendor Advisory, Exploit
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-91766?
How severe is CVE-2026-91766?
How do I fix CVE-2026-91766?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91760Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic …7
- CVE-2026-91761UNIX Symbolic Link (Symlink) Following Vulnerability in Hita…8.2
- CVE-2026-91762UNIX Symbolic Link (Symlink) Following Vulnerability in Hita…7.9
- CVE-2026-91763UNIX Symbolic Link (Symlink) Following Vulnerability in Hita…8.2
- CVE-2026-91764Improper Link Resolution Before File Access Vulnerability in…8.1
- CVE-2026-91765cleanup_xml_node() in the SOAP XML parser recurses once per …7.5
- CVE-2026-91767php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c …6.5
- CVE-2026-91768The IPv6 branch of the FastCGI client access check compares …6.5
- CVE-2026-91769PHP's OpenSSL stream peer verification checks the certificat…4.3
- CVE-2026-9177A Server-Side Template Injection (SSTI) vulnerability was id…9.4
- CVE-2026-91770IceHRM before 36.0.0 fails to validate employee ownership on…6.5
- CVE-2026-91771Weights & Biases wandb before 0.29.0 fails to validate the f…8.8
Are you affected by CVE-2026-91766?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST