CVE-2026-44503CWE-601

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High · published May 14, 2026

CVSS v4.0
7.0
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00937 · 60.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-05-14T15:58Z
EPSS history
Timeline
  • 14 MAY 15:58Z
    Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
    cvelistv5