EXECUTIVE SUMMARY:
CVE-2026-55553, with a CVSS score of 7.5, is a high-severity vulnerability affecting urllib, allowing credential leakage when following cross-origin redirects due to the preservation of credential-bearing request headers verbatim, including Authorization, Cookie, Proxy-Authorization, and custom authentication headers, which can lead to credentials intended for the original origin being delivered to a redirected origin if the target is attacker-controlled or outside the trust boundary. This affects Node.js applications that use urllib to make authenticated HTTP requests while allowing redirects to be followed automatically, exposing credentials to an unintended origin and potentially enabling credential reuse against the original partner API or related services.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-55553, with a CVSS score of 7.5, is a high-severity vulnerability affecting urllib, allowing credential leakage when following cross-origin redirects due to the preservation of credential-bearing request headers verbatim, including Authorization, Cookie, Proxy-Authorization, and custom authentication headers, which can lead to credentials intended for the original origin being delivered to a redirected origin if the target is attacker-controlled or outside the trust boundary. This affects Node.js applications that use urllib to make authenticated HTTP requests while allowing redirects to be followed automatically, exposing credentials to an unintended origin and potentially enabling credential reuse against the original partner API or related services.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-hq3h-g68c-hp78