CVE-2026-54276: AIOHTTP DigestAuthMiddleware Cross-Origin Credential Disclosure

Technical summary

CVE-2026-54276 is a credential disclosure vulnerability in AIOHTTP versions before 3.14.1 affecting the DigestAuthMiddleware component. The vulnerability stems from inadequate validation of cross-origin redirects during digest authentication flows. When DigestAuthMiddleware processes a 3xx redirect response from a web service, it does not sufficiently restrict whether the authentication digest should be forwarded to the new location. If an attacker can trigger a cross-origin redirect (through an open redirect vulnerability on the target domain or similar control-flow issue), the middleware will send the HTTP Digest authentication header to the attacker's server. The digest itself is not plaintext, but it contains a hash of the user's password and other session material; an attacker with the digest can perform offline cracking attacks or credential stuffing if password hygiene is poor. The vulnerability requires user interaction (UI:R in the CVSS vector) and assumes either a pre-existing open redirect on the target or a similar weakness that allows redirect manipulation.

Business impact

Organizations using AIOHTTP as an HTTP client or server framework face a moderate risk of user credential compromise in environments where: (1) AIOHTTP-based clients authenticate to internal or third-party services using HTTP Digest authentication, (2) Target services have open redirects or similar redirect-control vulnerabilities, and (3) User passwords are weak, reused, or protected only by weak cryptography. The exposure is limited to digest hashes rather than plaintext passwords, which reduces immediate blast radius but increases risk if an attacker can crack the hash or leverage the digest in replay attacks. Organizations that do not use DigestAuthMiddleware or that do not authenticate using HTTP Digest are unaffected. This is a MEDIUM severity issue per CVSS 3.1 (score 6.1).

Affected systems

The vulnerability affects AIOHTTP versions prior to 3.14.1. The advisory identifies the affected package as 'aiohttp aiohttp'. This covers any Python application or service that imports aiohttp and uses the DigestAuthMiddleware class, particularly those that make authenticated HTTP requests to external or internal services that may redirect requests. Development teams, DevOps platforms, and microservices architectures relying on aiohttp are potential targets, as are any systems that proxy or forward authenticated HTTP traffic.

Exploitability

Exploitation is feasible but requires multiple conditions to align. An attacker needs: (1) knowledge that a target application uses AIOHTTP with DigestAuthMiddleware, (2) a way to trigger a cross-origin redirect on the target service (an open redirect or similar vulnerability), (3) a server capable of receiving and logging the forwarded digest, and (4) sufficient computational resources to crack the digest hash offline (or the ability to replay it in a authentication context). The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the attack is network-adjacent, requires low complexity once the redirect is achieved, requires no privileges, and depends on user interaction (clicking a link or following a redirect). The digest itself is not a complete credential, so post-exploitation value depends on password strength and reuse patterns. This is not currently listed in the CISA KEV catalog, indicating no widespread active exploitation has been reported.

Remediation

Upgrade AIOHTTP to version 3.14.1 or later. This release patches DigestAuthMiddleware to prevent digest credentials from being forwarded to cross-origin destinations. Additionally, organizations should: (1) audit their services for open redirect vulnerabilities and remediate them, (2) discontinue use of HTTP Digest authentication in favor of modern alternatives (OAuth 2.0, API tokens, TLS mutual authentication) where feasible, and (3) enforce strong password policies and monitor for credential reuse if Digest authentication cannot be immediately replaced.

Patch guidance

Patches are available in AIOHTTP version 3.14.1 and later. Verify the installed version with 'pip show aiohttp' or by inspecting your environment's package manifest. Update using 'pip install --upgrade aiohttp' or your distribution's package manager. Test the upgrade in a staging environment first to ensure compatibility with your application, as middleware changes may affect existing authentication flows. Pin the minimum version in your requirements.txt or pyproject.toml to aiohttp>=3.14.1 to prevent regression.

Detection guidance

Detection at the host/network level can focus on: (1) Monitoring AIOHTTP application logs for unexpected redirect events or 3xx responses followed by authentication headers being sent to off-domain destinations, (2) Inspecting HTTP request logs for Digest authentication headers (Authorization: Digest ...) appearing in requests to unexpected or attacker-controlled domains, (3) Reviewing application source code to identify usage of DigestAuthMiddleware and cross-origin redirect patterns, (4) Network-level detection of outbound authenticated HTTP requests crossing domain boundaries without explicit authorization. Intrusion detection signatures can flag suspicious patterns of digest authentication appearing in multi-domain request chains.

Why prioritize this

This vulnerability should be prioritized for organizations that meet ALL of the following criteria: (1) They use AIOHTTP version <3.14.1, (2) They deploy DigestAuthMiddleware for authentication, (3) Their target services have known or suspected open redirects, (4) Authenticated users interact with or log into external or untrusted domains. Conversely, if your organization uses modern authentication (OAuth, JWT, mutual TLS) and does not rely on HTTP Digest, or if AIOHTTP is only used for non-authenticated requests, urgency is lower. The MEDIUM CVSS score and lack of KEV status suggest this is not an immediate emergency, but patching should be included in the next routine update cycle.

Risk score, explained

CVSS 3.1 score 6.1 (MEDIUM) reflects: (1) Network accessibility (AV:N) — the vulnerability is reachable over the network without special access, (2) Low attack complexity (AC:L) — once a redirect is triggered, the middleware's behavior is deterministic, (3) No authentication required (PR:N) — an attacker does not need valid credentials initially, (4) User interaction required (UI:R) — the user must be redirected or follow a link, (5) Changed scope (S:C) — the impact affects other domains/services beyond the original target, (6) Low confidentiality impact (C:L) — credential material is disclosed but not plaintext passwords, (7) Low integrity impact (I:L) — the attacker can potentially replay or manipulate the digest, (8) No availability impact (A:N) — the service remains operational. The 6.1 score appropriately captures a moderate but non-critical risk that requires patching but not emergency intervention.

Frequently asked questions