CVE-2026-48022Medium· 6.5▾ Sunlit@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. The fix replaces the hostname comparison with a full-origin comparison (scheme, host, and port), aligning the behavior with the WHATWG Fetch same-origin definition used by browsers.
Upgrade to >= 18.1.2.
redirects: 0 (default) and handle redirects manually with a strict origin check.beforeRedirect hook to inspect the redirect target and abort or strip sensitive headers before the follow-on request.@hapi/wreck < 18.1.2Upgrade to a patched release:
@hapi/wreck 18.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2026-48049Medium· 5.3@hapi/inert has a static-file confinement bypass via sibling-prefix path
CVE-2025-31976Medium· 4.8HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrat…
CVE-2021-32822Medium· 4.0hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration
CVE-2013-10077Medium· 5.3OctoPrint API Key settings.py getSettings information disclosure