CVE-2026-54276

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54276
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54276.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54276
Aliases
Downstream
Published
2026-06-22T16:36:23Z
Modified
2026-09-19T03:47:12Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
Details

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54276.json"
}
References

Affected packages

Git / github.com/aio-libs/aiohttp

Affected ranges

Type
GIT
Repo
https://github.com/aio-libs/aiohttp
Events
Introduced
7a6ee687e945902d55eb08027987ac34c5f02840
Fixed
9c35d03aa5fecd294510196e07f176f1a2e7fa33
Fixed
38d16060037e1bfcd6d677abababa3c2a4bb58fa
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.12.0"
        },
        {
            "fixed": "3.14.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.12.0
v3.13.0
v3.14.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54276.json"