CVE-2026-47265 MEDIUM

CVE-2026-47265: AIOHTTP vulnerable to cross-origin redirect with per-request cookies

Vendor Aio-Libs
Product aiohttp
Weakness CWE-346 · Origin validation
Published June 2, 2026
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

6.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

Key dates

02Disclosure timeline

June 2, 2026 CVE published
June 3, 2026 Record updated