CVE-2026-91766: HTTP Stream Wrapper Information Disclosure

CVE-2026-91766 Overview

CVE-2026-91766 affects the PHP http:// stream wrapper. The wrapper forwards user-supplied Authorization, Cookie, and Proxy-Authorization headers unchanged when it follows an HTTP redirect. The forwarding occurs even when the redirect points to a different host, a different port, or downgrades the connection from HTTPS to HTTP. An attacker who controls a redirect response can harvest credentials that were intended only for the original origin. The flaw mirrors the libcurl issue fixed in version 7.58.0 as CVE-2018-1000007. PHP tracks the issue as a sensitive information exposure weakness classified under [CWE-200].

Critical Impact
Sensitive authentication headers can leak to attacker-controlled hosts across redirects, enabling credential theft and downstream account takeover.

Affected Products

PHP php-src HTTP stream wrapper (see the GitHub Security Advisory)
Applications using file_get_contents(), fopen(), or similar functions over http:// or https:// with custom headers
PHP HTTP context options that set Authorization, Cookie, or Proxy-Authorization headers

Discovery Timeline

2026-09-25 - CVE-2026-91766 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-91766

Vulnerability Analysis

The PHP HTTP stream wrapper handles redirect responses by reissuing the request against the Location header target. The wrapper does not strip sensitive headers before replaying the request. Any header supplied through the header context option travels with the second request, including bearer tokens, session cookies, and proxy credentials.

This behavior violates the origin boundary expected by developers. Code that calls file_get_contents() with an Authorization: Bearer <token> header assumes the token reaches only the host named in the URL. A 302 response pointing to an attacker-controlled server breaks that assumption and discloses the token.

The issue is classified as information disclosure [CWE-200]. Exploitation requires that the attacker influence a redirect served by, or returned through, a resource the victim application fetches. EPSS currently estimates the probability of exploitation activity in the near term as low.

Root Cause

The stream wrapper lacks the header-stripping logic that other HTTP clients adopted after the equivalent libcurl flaw. There is no cross-origin check comparing the original request target to the redirect target before replaying headers.

Attack Vector

An attacker needs a way to make a PHP application fetch a URL that returns a redirect to a host the attacker controls. Common patterns include URL-fetching features such as webhook validators, image proxies, link preview generators, and server-side API clients. When the application attaches credentials via the HTTP context, the attacker's logging server receives those credentials in the replayed request.

The vulnerability affects the mechanism rather than a single function. See the PHP Security Advisory GHSA-fpwc-w8rq-cr92 for technical details and the fix description.

Detection Methods for CVE-2026-91766

Indicators of Compromise

Outbound HTTP requests from PHP worker processes to unexpected hosts shortly after legitimate API calls
Access logs on attacker-controlled infrastructure showing Authorization, Cookie, or Proxy-Authorization headers originating from your PHP services
Use of credentials or session tokens from source IP addresses that do not match normal application egress

Detection Strategies

Audit PHP code for calls to file_get_contents(), fopen(), stream_context_create(), and SoapClient that attach credential headers to http:// or https:// URLs
Inspect HTTP egress telemetry for 3xx responses followed by a request to a different registered domain carrying the same Authorization header
Review web application firewall and proxy logs for redirect chains that cross origin boundaries during server-side fetches

Monitoring Recommendations

Route PHP outbound HTTP traffic through a forward proxy that logs destination hosts and header fingerprints
Alert on authentication events using tokens issued to a backend service but presented from unknown source addresses
Baseline the set of hosts each PHP service contacts and alert on first-seen destinations

How to Mitigate CVE-2026-91766

Immediate Actions Required

Upgrade PHP to the patched release referenced in the GitHub Security Advisory
Inventory server-side HTTP calls that attach Authorization, Cookie, or Proxy-Authorization headers and audit the destinations they fetch
Rotate any long-lived bearer tokens or session cookies that may have been exposed through vulnerable fetch paths

Patch Information

The PHP project has published the fix through the advisory GHSA-fpwc-w8rq-cr92. Apply the vendor-supplied patch or upgrade to the fixed PHP version provided by your distribution.

Workarounds

Disable automatic redirect following by setting max_redirects to 0 in the HTTP stream context when sending credentials
Validate the redirect target host in application code before replaying the request, and strip credential headers on cross-origin redirects
Replace http:// stream wrapper calls with an HTTP client library that enforces cross-origin header stripping, such as a current libcurl-based client

bash

# Configuration example: disable redirects when sending credentials
# php stream context option
$ctx = stream_context_create([
    'http' => [
        'method'        => 'GET',
        'header'        => "Authorization: Bearer $token\r\n",
        'max_redirects' => 0,
        'follow_location' => 0,
    ],
]);
$response = file_get_contents($url, false, $ctx);