CVE-2026-47070 — Open Redirect in Benoitc Hackney

Vendor	Product	Version range	Fixed in
benoitc	hackney	>= 3.1.1 < 4.0.1	4.0.1
benoitc	hackney	>= 3.1.1 < 4.0.1	4.0.1
benoitc	hackney	>= 3.1.1 < 4.0.1	4.0.1
benoitc	hackney	>= e61b7d04b7826847e1efe614106ef4d580c78eab < c58d5b50bade146360b85caf3dc8065807b08246	c58d5b50bade146360b85caf3dc8065807b08246

GHSA

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

ghsa·2026-06-26·CVSS 9.8

CVE-2026-47070 [CRITICAL] CWE-601 Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body ### Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for 307/308 responses, the original request body to the redirect target without checking whether the target host matches the origin. When `follow_redirect` is enabled and a server responds with a cross-origin `Location`, hackney delivers the caller's credentials verbatim to the attacker-controlled host. The main hackney HTTP/1 client has `maybe_strip_auth_on_redirect/2` (the fix for CVE-2018-1000007); the H3 client was added later without it. ### Details In `src/hackney_h3.erl`, `handle_redirect/11` (line 165) extracts the redirect target from the server-

CVEList

HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

cvelistv5·2026-05-25·CVSS 9.8

CVE-2026-47070 [CRITICAL] CWE-601 HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin. The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection

VulDB

benoitc hackney up to 4.0.0 src/hackney_h3.erl redirect (EUVD-2026-31692)

vuldb·2026-05-25

CVE-2026-47070 [LOW] benoitc hackney up to 4.0.0 src/hackney_h3.erl redirect (EUVD-2026-31692) A vulnerability categorized as problematic has been discovered in benoitc hackney up to 4.0.0. Affected by this issue is some unknown functionality of the file src/hackney_h3.erl. The manipulation results in open redirect. This vulnerability is known as CVE-2026-47070. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

CVE-2026-47070: Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the…

Affected

CVSS provenance