CVE-2026-47265: AIOHTTP Cookie Leak on Cross-Origin Redirects (CVSS 7.5)

Technical summary

CVE-2026-47265 concerns improper cookie transmission in AIOHTTP's redirect handling. The vulnerability stems from the framework forwarding cookies set via the per-request `cookies` parameter when following HTTP redirects to different origins. This violates secure cookie policy, which dictates that cookies should generally remain confined to their originating domain. The attack surface is cross-origin: if an attacker controls a redirect target URL or can manipulate a redirect response, they can observe cookies intended only for the original request domain. The CVSS 3.1 score of 7.5 (HIGH) reflects the high-confidence confidentiality impact without requiring authentication or user interaction, though integrity and availability remain unaffected. The vulnerability is categorized under CWE-346 (Origin Validation Error).

Business impact

Organizations using AIOHTTP to build services that authenticate users or handle sensitive session data face exposure of authentication credentials to attacker-controlled domains. The practical impact depends on deployment architecture: services that make cross-origin API calls with per-request cookie authentication are at highest risk. Compromised cookies could enable session hijacking, unauthorized API calls, or lateral movement within multi-tenant systems. The risk is particularly acute in microservices environments where internal service-to-service calls might unknowingly traverse untrusted redirect chains. Any SaaS platform or internal tool relying on AIOHTTP's cookie handling should treat this as a priority security event.

Affected systems

The vulnerability affects AIOHTTP versions prior to 3.14.0. Any Python application using AIOHTTP as an HTTP client that passes cookies via the `cookies` parameter on individual requests is potentially affected. The issue does not affect applications that manage cookies exclusively through the `Cookie` header in the `headers` parameter, providing a mitigation path for those unable to upgrade immediately. Applications not using request-level cookie parameters are unaffected.

Exploitability

The vulnerability has a low barrier to exploitation. An attacker requires network positioning to observe or influence redirect targets—typically achievable through DNS hijacking, BGP hijacking, or control of a legitimate redirect destination. No authentication or special privileges are required to trigger the vulnerability; a simple malicious redirect URL suffices. However, the attack requires either developer misconfiguration (using cross-origin redirects with cookies) or active attacker intervention in the redirect chain. The public availability of AIOHTTP code means the attack vector is well-understood by determined threat actors. Notably, this vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade AIOHTTP to version 3.14.0 or later as soon as feasible. For teams unable to upgrade immediately, refactor cookie handling to use the `Cookie` header within the `headers` parameter instead of the `cookies` parameter; this approach is not vulnerable to the redirect issue. Additionally, implement strict redirect validation policies to prevent unexpected cross-origin redirects, and consider leveraging AIOHTTP's connector settings to disable automatic redirects if your application logic does not require them. Review all code that uses the `cookies` parameter with external or user-controlled redirect destinations.

Patch guidance

Upgrade AIOHTTP to version 3.14.0 or later. Check your dependency management tool (pip, poetry, pipenv) for the latest release and test in a staging environment before production deployment. Review release notes for any breaking changes or deprecations. For Python environments using pinned dependencies, update your requirements files and run your full test suite prior to rollout. Monitor AIOHTTP's GitHub repository for any post-release security advisories.

Detection guidance

Review your application logs and network telemetry for cross-origin redirect requests that carry cookies set via AIOHTTP's `cookies` parameter. Check for POST or GET requests that originate from your infrastructure and redirect to external or unexpected domains, particularly those with credentials in the request. Monitor for unusual access patterns from known-good services accessing third-party URLs. Examine AIOHTTP dependency versions in your codebase using `pip show aiohttp` or your package manager's audit features. Implement alerting on redirect chains that cross domain boundaries and carry authentication headers or cookies.

Why prioritize this

This vulnerability warrants urgent attention due to its HIGH CVSS score (7.5), straightforward exploitability via network-based manipulation, and potential for widespread credential compromise. Organizations should prioritize patching production AIOHTTP deployments, especially those in security-sensitive roles (authentication services, API gateways, data processors). The ease of exploitation combined with the high confidentiality impact makes this a candidate for rapid remediation timelines. While not yet in the KEV catalog, the attack vector is clear and likely to attract threat actor interest if not addressed quickly.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) network-based attack vector requiring no special privileges or user interaction; (2) low attack complexity—the vulnerability is triggered by normal redirect behavior; (3) high confidentiality impact, as sensitive cookies and authentication tokens can be exfiltrated; and (4) no integrity or availability impact, keeping the severity from reaching critical levels. The score appropriately captures a well-understood, remotely exploitable vulnerability with serious confidentiality implications but limited scope.

Frequently asked questions