Log in / Sign up

Vulnerability details

CVE-2026-73116

Apache Software Foundation Apache Juneau

Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

CVSS 4.0
10.0Critical

Official description

Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.

CVSS scores

ScoreVersionSourceVector
10.0Critical 4.0 CVEProject cvelistV5 (CNA) (apache) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected products

VendorProductVersionsSource
Apache Software Foundation Apache Juneau v < 9.2.1 CVEProject cvelistV5 (CNA)
Apache Software Foundation Apache Juneau v < 9.2.1 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-11-05
Last updated
2026-11-05
State
Published
Assigner (CNA)
apache
Kolun priority
24 · Low

Exploit prediction (EPSS)

0.4%
Probability of exploitation in 30 days
35%
Percentile (among all CVEs)

Weaknesses (CWE)

  • CWE-522
    Insufficiently Protected Credentials