CVE-2026-34518: AIOHTTP Information Disclosure Flaw

CVE-2026-34518 Overview

AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, contains an information exposure vulnerability in versions prior to 3.13.4. When the HTTP client follows redirects to a different origin, AIOHTTP correctly drops the Authorization header but fails to drop the Cookie and Proxy-Authorization headers. This inconsistent header handling can lead to sensitive credential leakage when requests are redirected to untrusted or third-party domains.

Critical Impact

Sensitive authentication credentials stored in Cookie and Proxy-Authorization headers may be inadvertently transmitted to malicious or unintended third-party servers during cross-origin redirects.

Affected Products

• AIOHTTP versions prior to 3.13.4
• Python applications using AIOHTTP HTTP client with redirect following enabled
• Asyncio-based services leveraging AIOHTTP for outbound HTTP requests

Discovery Timeline

• April 1, 2026 - CVE-2026-34518 published to NVD
• April 1, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34518

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in AIOHTTP's inconsistent handling of sensitive HTTP headers during cross-origin redirect scenarios.

When an HTTP client follows a redirect from one origin to another (e.g., from https://trusted-site.com to https://attacker-controlled.com), security best practices dictate that sensitive authentication headers should be stripped to prevent credential leakage. AIOHTTP implements this protection for the Authorization header but fails to apply the same safeguard to Cookie and Proxy-Authorization headers.

This creates a dangerous scenario where an attacker who can control redirect destinations—either through compromised servers, open redirects, or man-in-the-middle attacks—can harvest session cookies and proxy credentials from unsuspecting applications.

Root Cause

The root cause is incomplete implementation of redirect security controls in AIOHTTP's HTTP client. The redirect handling logic was designed to strip the Authorization header when the target origin differs from the original request origin, but this protection was not extended to cover Cookie and Proxy-Authorization headers, which contain equally sensitive authentication material.

Attack Vector

An attacker can exploit this vulnerability through several vectors:

1. Malicious Redirect Chains: An attacker controls a server that issues a redirect to their credential-harvesting endpoint, causing the victim's AIOHTTP client to send cookies and proxy credentials to the attacker's server.

2. Open Redirect Exploitation: Leveraging open redirect vulnerabilities in trusted sites to redirect AIOHTTP client requests to attacker-controlled domains while preserving sensitive headers.

3. Compromised Intermediate Services: If any service in the request chain is compromised, it can redirect requests to exfiltrate authentication credentials from applications using vulnerable AIOHTTP versions.

The attack requires network-level access and the ability to influence redirect responses, either through direct server control or through exploiting existing vulnerabilities in the target application's request flow.

Detection Methods for CVE-2026-34518

Indicators of Compromise

• Unexpected outbound HTTP requests containing Cookie or Proxy-Authorization headers to third-party domains
• Application logs showing redirect chains that traverse different origins
• Network traffic analysis revealing sensitive headers being sent to untrusted destinations
• Increased authentication failures potentially indicating session token theft

Detection Strategies

• Monitor outbound HTTP traffic for redirect patterns crossing origin boundaries while carrying sensitive headers
• Implement application-level logging to track AIOHTTP client redirect behavior and header retention
• Use network security tools to alert on Cookie or Proxy-Authorization headers sent to domains outside an approved allowlist
• Review dependency manifests to identify applications using AIOHTTP versions prior to 3.13.4

Monitoring Recommendations

• Deploy network monitoring rules to detect cross-origin requests containing authentication cookies
• Implement runtime application security monitoring to track header handling during redirects
• Establish baseline patterns for normal AIOHTTP client behavior to identify anomalous redirect chains
• Use software composition analysis tools to continuously monitor for vulnerable AIOHTTP versions in your environment

How to Mitigate CVE-2026-34518

Immediate Actions Required

• Upgrade AIOHTTP to version 3.13.4 or later immediately
• Audit applications using AIOHTTP to identify instances where redirect following is enabled with sensitive headers
• Consider disabling automatic redirect following in AIOHTTP clients until patching is complete
• Review application logs for signs of potential credential exposure through cross-origin redirects

Patch Information

The vulnerability has been addressed in AIOHTTP version 3.13.4. The fix ensures that Cookie and Proxy-Authorization headers are properly stripped when following redirects to different origins, consistent with the existing behavior for the Authorization header.

For detailed patch information, refer to the GitHub commit implementing the fix, the GitHub Release v3.13.4, and the GitHub Security Advisory GHSA-966j-vmvw-g2g9.

Workarounds

• Disable automatic redirect following in AIOHTTP and implement manual redirect handling with proper header stripping
• Use a network proxy or firewall to prevent requests with sensitive headers from reaching untrusted destinations
• Implement application-level middleware to intercept and sanitize headers before following redirects
• Limit the domains that AIOHTTP clients are permitted to follow redirects to using an allowlist approach

# Upgrade AIOHTTP to patched version
pip install --upgrade aiohttp>=3.13.4

# Verify installed version
pip show aiohttp | grep Version