AIKIDO-2026-118856
websockets is vulnerable to Information Disclosure
61
CVE Score
Medium
Information Disclosure
TL;DR
The asyncio and legacy WebSocket clients replay any configured Authorization, Cookie, and Proxy-Authorization headers unchanged when following a redirect to a different origin. A cross-origin redirect target then receives those credentials in the follow-up connection attempt. This exposes secrets that were only meant for the original host to whatever server controls the redirect. The fix strips these headers from additional_headers before reconnecting to the redirect target.
How do I fix this?
Upgrade the websockets library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your client sends Authorization, Cookie, or Proxy-Authorization headers while following redirects to servers on a different origin. The legacy client is affected from 8.0; the asyncio client from 13.1.
Package
Versions
8.0 - 16.0
Fixed in 16.1Background info
websockets is vulnerable to Information Disclosure in versions 8.0 - 16.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.