---
schema_version: '1.0'
id: security-20260714-dcbe9c
url: https://osv.dev/vulnerability/PYSEC-2026-2109
url_hash: dcbe9c843970718f3966b154daad7cf3c42859453793ef843aece65218a40ed5
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2109
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54276
- PYSEC-2026-2109
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- aiohttp
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:42:55Z'
status: published
content_hash: 1fa7778be2e848f1acba0ef01e56d257d0ec2a8a5a3ff2b29d9fb7f31c05add2
license_note: full
summary: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
  Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after
  following a cross-origin redirect. This likely requires an open redirect vulnerability
  or similar on the target domain f
summary_source: rss
summary_en: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response
  after following a cross-origin redirect. This likely requires an open redirect vulnerability
  or similar on the target domain f
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54276 — aiohttp
---

# CVE-2026-54276 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain f

## Key Points
- cve / CVE-2026-54276 / PYSEC-2026-2109 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
**Advisory:** PYSEC-2026-2109 (CVE-2026-54276)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp
- https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2109_

## Source
元記事: [CVE-2026-54276 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2109) — published 2026-06-22T18:16:46Z