CVE-2026-54276: AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
Summary
DigestAuthMiddleware can send an authentication response after following a cross-origin redirect.
Impact
If the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.
This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.
Workaround
Disable followredirects if this is a concern.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aio-libs/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch 38d16060037e1bfcd6d677abababa3c2a4bb58fa - Configuration
Disable follow_redirects to prevent DigestAuthMiddleware from following cross-origin redirect challenges that could allow an attacker to extract the auth digest.
AIOHTTP DigestAuthMiddleware follow_redirects = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54276?
CVE-2026-54276 has a risk rating of 27.
What is CVE-2026-54276 about?
CVE-2026-54276 involves the `DigestAuthMiddleware` potentially allowing authentication responses to be sent after following a cross-origin redirect.
How does CVE-2026-54276 impact users?
The vulnerability could allow an attacker to extract the authentication digest if a user follows a redirect to a malicious domain.
How do I fix CVE-2026-54276?
To fix CVE-2026-54276, update your aiohttp library to the latest version that addresses this vulnerability.
What is the default behavior that leads to CVE-2026-54276?
The default behavior of following redirects in aiohttp can expose users to this vulnerability.