AIKIDO-2026-133006
aiohttp is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
37
Low Risk
This Affects:
aiohttpTL;DR
The client's cross-origin redirect guard in ClientSession._request strips Authorization, Cookie and Proxy-Authorization headers using pop, which removes only the first entry for a header name. When a request carries duplicate copies of one of those headers, the surviving duplicate is not removed and is forwarded to the redirect target on a different origin. This can leak credentials or session material to an unintended third-party host. The fix uses popall so every copy of each sensitive header is dropped when a redirect crosses an origin.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application sends duplicate Authorization, Cookie, or Proxy-Authorization headers on requests that follow cross-origin redirects.
Background info
aiohttp is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 2.3.0 - 3.14.2.
How to fix this
Upgrade the aiohttp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant