---
schema_version: '1.0'
id: security-20260711-a38446
url: https://osv.dev/vulnerability/GHSA-hpj7-wq8m-9hgp
url_hash: a3844681781528fe4528f79e3f6a3b67cbdd57bb0d83f7a0fff07e0f161e294d
canonical_url: https://osv.dev/vulnerability/GHSA-hpj7-wq8m-9hgp
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54276
- GHSA-hpj7-wq8m-9hgp
- severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- aiohttp
- PyPI
lang: en
published_at: '2026-06-15T20:09:06Z'
fetched_at: '2026-07-11T06:37:17Z'
updated_at: '2026-07-11T06:38:28Z'
status: published
content_hash: e97b98a7d1f2a04ec51110e1b2736d766de2235c93ef03bf14ec8dd4207a13a1
license_note: full
summary: 'aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect
  Challenges'
summary_source: rss
summary_en: 'aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect
  Challenges'
entities: []
key_facts: []
related: []
related_auto: []
title: 'CVE-2026-54276: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin
  Redirect Challenges'
---

# CVE-2026-54276: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

## TL;DR
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

## Key Points
- cve / CVE-2026-54276 / GHSA-hpj7-wq8m-9hgp / severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N / aiohttp / PyPI

## Details
**Severity:** CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
**Advisory:** GHSA-hpj7-wq8m-9hgp (CVE-2026-54276)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
### Summary

``DigestAuthMiddleware`` can send an authentication response after following a cross-origin redirect.

### Impact

If the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.

This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.

### Workaround

Disable ``follow_redirects`` if this is a concern.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp
- https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa
- https://github.com/aio-libs/aiohttp

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-hpj7-wq8m-9hgp_

## Source
元記事: [CVE-2026-54276: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges](https://osv.dev/vulnerability/GHSA-hpj7-wq8m-9hgp) — published 2026-06-15T20:09:06Z