Bug 2541649 (CVE-2026-91766) - CVE-2026-91766 php: php: Credential disclosure via cross-origin HTTP redirects
Summary: CVE-2026-91766 php: php: Credential disclosure via cross-origin HTTP redirects
Keywords:
Status: NEW
Alias: CVE-2026-91766
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2552133
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-25 20:58 UTC by OSIDB Bzimport
Modified: 2026-10-21 15:45 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:87080 0 None None None 2026-10-21 15:45:06 UTC

Description OSIDB Bzimport 2026-09-25 20:58:31 UTC 
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
Comment 1 Jon Orris 2026-10-21 15:45:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87080 https://access.redhat.com/errata/RHSA-2026:87080
Note You need to log in before you can comment on or make changes to this bug.