{"id":"CVE-2026-47265","aliases":["GHSA-hg6j-4rv6-33pg","PYSEC-2026-2105"],"title":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","severity":"medium","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.0"],"patched":["aiohttp 3.14.0"],"published":"2026-06-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:49.888335735Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hg6j-4rv6-33pg","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265"},{"url":"https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["osv","pip"],"epss":0.0015,"epssPercentile":0.04575,"ingestedAt":"2026-07-13T18:57:59.162Z","slug":"CVE-2026-47265","body":"## Overview\n\n### Summary\n\nCookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.\n\n### Impact\n\nIf a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.\n\n### Workaround\n\nIf unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478\n\n## Affected packages\n\n- `aiohttp < 3.14.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}