Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-73116: Apache Juneau RestClient may send credentials to other sites
CVE-2026-73116 · published 4 days ago
Summary
The RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session cookies, sending them to a different server or to an unencrypted connection. This could let an unintended party see or use those credentials. Upgrade to version 9.2.1, or disable automatic redirects and remove credential headers when redirects cross to another site.
What to do
- Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache juneau | < 9.2.1 |
Original advisory text
Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
Insufficiently Protected Credentials vulnerability in Apache Juneau.
The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Track software like this
Free during beta