---
id: CVE-2026-113440
title: >-
  HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different
  scheme or port in hackney
summary: >-
  Insufficiently Protected Credentials vulnerability in hackney in benoitc
  hackney allows a redirecting server to obtain the basic_auth and cookie
  credentials of a request via a same-host redirect to another scheme or port.
  With follow_red…
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-522
vendor: benoitc
product: hackney
affected:
  - hackney >= 2.0.0 < 4.9.0
  - >-
    benoitc/hackney >= 8f944559bdb83da60b5c06f6cf6d842591278364 <
    6548384b22ea196023a1963e2967d5715b6d9564
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T13:49:17.377Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113440'
references:
  - url: 'https://github.com/benoitc/hackney/pull/979'
    label: >-
      Strip basic_auth and cookie on redirects that change scheme or port
      (benoitc/hackney#979)
  - url: 'https://cna.erlef.org/cves/CVE-2026-113440.html'
    label: EEF CNA record for CVE-2026-113440
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-113440'
    label: OSV record EEF-CVE-2026-113440
  - url: 'https://github.com/benoitc/hackney/releases/tag/4.9.0'
    label: hackney 4.9.0 release notes
  - url: >-
      https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364
    label: Introducing commit 8f94455 in benoitc/hackney
  - url: >-
      https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564
    label: Fix commit 6548384 in benoitc/hackney
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.816Z'
epss: 0.00313
epssPercentile: 0.2406
---

## Overview

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.

This issue affects hackney: from 2.0.0 before 4.9.0.

## Affected

- `hackney >= 2.0.0 < 4.9.0`
- `benoitc/hackney >= 8f944559bdb83da60b5c06f6cf6d842591278364 < 6548384b22ea196023a1963e2967d5715b6d9564`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Disable follow_redirect and handle the Location header in the application, or pass the credentials as explicit Authorization and Cookie request headers instead of the basic_auth and cookie options. hackney:follow_redirect/10 issues the redirected request with an empty header list, so explicit headers reach the first server only.