AIKIDO-2026-488356

TL;DR

urllib follows HTTP redirects when followRedirect is enabled and reuses the caller-supplied request options on each hop. On a cross-origin redirect it forwards credential-bearing headers such as Authorization, Cookie, and Proxy-Authorization, and re-applies the auth/digestAuth options, to the new origin. An attacker-controlled, compromised, or misconfigured redirect target can therefore receive credentials that were intended only for the original host. The fix detects cross-origin redirects and strips these credential headers and clears auth/digestAuth, while leaving same-origin redirects and the caller's headers object unchanged.