CVE-2026-103030 with a CVSS score of 7.5 is a sensitive information disclosure vulnerability in dio_http2_adapter. The flaw occurs when Dio is configured to use Http2Adapter and follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. Because followRedirects is enabled by default and maxRedirects defaults to five, an unauthenticated network attacker who controls or compromises any HTTP server contacted by the victim can return a cross-origin 302 redirect to an attacker-owned server. The adapter then forwards the original Authorization, Cookie, and Proxy-Authorization headers verbatim to that new authority, exposing bearer tokens, session cookies, and proxy credentials. The attack requires no prior authentication and has low complexity. Business impact is high confidentiality loss: stolen credentials may be used to impersonate the victim against the original service or any other service that accepts the same token, potentially leading to account takeover, unauthorized access, data exposure, and loss of trust in applications that use authenticated HTTP/2 requests through the adapter.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-103030 with a CVSS score of 7.5 is a sensitive information disclosure vulnerability in dio_http2_adapter. The flaw occurs when Dio is configured to use Http2Adapter and follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. Because followRedirects is enabled by default and maxRedirects defaults to five, an unauthenticated network attacker who controls or compromises any HTTP server contacted by the victim can return a cross-origin 302 redirect to an attacker-owned server. The adapter then forwards the original Authorization, Cookie, and Proxy-Authorization headers verbatim to that new authority, exposing bearer tokens, session cookies, and proxy credentials. The attack requires no prior authentication and has low complexity. Business impact is high confidentiality loss: stolen credentials may be used to impersonate the victim against the original service or any other service that accepts the same token, potentially leading to account takeover, unauthorized access, data exposure, and loss of trust in applications that use authenticated HTTP/2 requests through the adapter.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]