VULNERABILITY INTELLIGENCE
CVE-2026-44503
EPSS probability0.64%
CISA KEVNot currently listed
Published2026-05-14
Last modified2026-10-26
Description
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Weakness classification
- security-advisories@github.com: CWE-601