CVE-2026-107714
published 2026-10-08CVE-2026-107714: The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.23%
12.7th percentile
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| sparklemotion | mechanize | < 2.15.0 | 2.15.0 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Sparklemotion Mechanize up to 2.14.0 Response Redirect Agent#response_redirect cross-domain policy
vuldb·2026-10-09·CVSS 5.9
CVE-2026-107714 [MEDIUM] Sparklemotion Mechanize up to 2.14.0 Response Redirect Agent#response_redirect cross-domain policy
A vulnerability was found in Sparklemotion Mechanize up to 2.14.0. It has been rated as problematic. Affected is the function Mechanize::HTTP::Agent#response_redirect of the component Response Redirect. The manipulation leads to permissive cross-domain policy with untrusted domains.
This vulnerability is uniquely identified as CVE-2026-107714. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
Red Hat
mechanize: mechanize: Information disclosure via improper redirect scheme and port handling
vendor_redhat·2026-10-08·CVSS 5.9
CVE-2026-107714 [MEDIUM] CWE-346 mechanize: mechanize: Information disclosure via improper redirect scheme and port handling
mechanize: mechanize: Information disclosure via improper redirect scheme and port handling
A flaw was found in mechanize. The library treats redirects to the same host as same-origin requests without verifying whether the communication protocol scheme or port has changed. A malicious server can exploit this flaw to cause information disclosure by redirecting connections from secure HTTPS to unencrypted HTTP or to alternate ports, exposing caller-supplied authentication credentials and session cookies.
Package: 3scale-amp2/system-rhel8 (Red Hat 3scale API Management Platform 2) - Out of support scope
No detection rules found.
No public exploits indexed.
https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4fhttps://github.com/sparklemotion/mechanize/commit/2f97fe358a91928e5e48221f2ec5cb50fa1a43bahttps://github.com/sparklemotion/mechanize/pull/676https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99
2026-10-08
Published