CVE-2026-54276: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

June 15, 2026

DigestAuthMiddleware can send an authentication response after following a cross-origin redirect.

References

github.com/advisories/GHSA-hpj7-wq8m-9hgp
github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp
nvd.nist.gov/vuln/detail/CVE-2026-54276

Code Behaviors & Features

Detect and mitigate CVE-2026-54276 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →