AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.
PUBLISHED5.2CWE-200CWE-522
AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
Problem type
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-522: Insufficiently Protected Credentials
Affected products
aio-libs
aiohttp
< 3.14.1 - AFFECTED
References
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp
https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
GitHub Security Advisories
GHSA-hpj7-wq8m-9hgp
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
https://github.com/advisories/GHSA-hpj7-wq8m-9hgpSummary
DigestAuthMiddleware can send an authentication response after following a cross-origin redirect.
Impact
If the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.
This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.
Workaround
Disable follow_redirects if this is a concern.
Patch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-54276Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-54276",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-06-22T16:36:23.022Z",
"dateReserved": "2026-06-12T17:13:32.280Z",
"datePublished": "2026-06-22T16:36:23.022Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-06-22T16:36:23.022Z"
},
"title": "AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges",
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1."
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.1",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-522: Insufficiently Protected Credentials",
"cweId": "CWE-522",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp",
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa",
"name": "https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{}
]
}
}
}