Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basicauth and…
CVE-2026-113440
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basicauth and cookie credentials of a request via a same-host redirect to another scheme or port. With followredirect enabled, hackney:followredirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybestripauthonredirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. locationtrusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.
Assessment
- CVSS
- 6 (v4.0)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 26 October 2026
- Weakness
- CWE-522
- Assigner
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
- https://cna.erlef.org/cves/CVE-2026-113440.html
- https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564
- https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364
- https://github.com/benoitc/hackney/pull/979
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://osv.dev/vulnerability/EEF-CVE-2026-113440
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-113440