What’s Vulnerable › Vulnerabilities

CVE-2022-0451: Auth bypass in Dark SDK

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-18 · updated 2026-06-17
• Weakness: CWE-305

Description

Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.

Affected products

• Google LLC Dart SDK: before 2.16.0 — fixed in 2.16.0

How to fix

Upgrade to a fixed version: Google LLC Dart SDK 2.16.0. Check the vendor advisory for mitigations.

References

• https://dart-review.googlesource.com/c/sdk/+/229947
• https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc
• https://dart-review.googlesource.com/c/sdk/+/229947
• https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc

Get alerted when CVE-2022-0451 or the next vulnerability affects your stack