CVE-2026-54276: AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-200

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.

Affected products

aio-libs aiohttp: from 3.12.0 before 3.14.1 — fixed in 3.14.1
Pypi Aiohttp: before 3.14.1; 0.1, 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.12.0 (+301) — fixed in 3.14.1

How to fix

Upgrade to a fixed version: aio-libs aiohttp 3.14.1; Pypi Aiohttp 3.14.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54276 or the next vulnerability affects your stack