CVE-2026-107715Medium· 6.8▾ TwilightPoC availableThe Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize:…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 37.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Exploit / PoC code exists
0.4% → 0.5%
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mechanize < 2.14.1Patched in:
mechanize 2.14.1Source: https://github.com/advisories/GHSA-2mwr-xjcg-37j7
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107399Medium· 6.8The Mechanize library is used for automating interaction with websites
CVE-2026-107714Medium· 5.9The Mechanize library is used for automating interaction with websites
CVE-2024-3656High· 8.1A flaw was found in Keycloak
CVE-2021-27568Medium· 5.9An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4
CVE-2018-5407Medium· 4.7Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2019-13057Medium· 4.9An issue was discovered in the server in OpenLDAP before 2.4.48