AIKIDO-2026-626049

TL;DR

The SDK reuses pooled keep-alive HTTP connections across requests within a single process. When an application-level timeout or thread interruption aborts a request after the socket has been used but before a response is returned, the SDK leaves the half-used connection in the pool instead of discarding it. A subsequent request that picks up that connection can then read a response belonging to the earlier interrupted request, delivering one user's authentication data to a different user in the same process. The fix wraps each request so that any exit other than a returned response removes and closes the cached connection before it can be reused.