CVE-2026-47265CWE-346

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

Medium · published June 2, 2026

CVSS v4.0
6.6
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

The record
Technical detail
CVSS v4.0
6.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00213 · 11.1th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-06-02T18:32Z
EPSS history
Timeline
  • 02 JUN 18:32Z
    AIOHTTP vulnerable to cross-origin redirect with per-request cookies
    cvelistv5