CVE-2026-103030: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in cfug dio
Description
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
CVSS v3.1
Score 7.5high
Affected software
cfug
dio
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Dio's Http2Adapter (versions >=1.0.0 <2.8.0) involves the _fetch method following HTTP/2 redirects by copying the original request headers, including sensitive ones like Authorization and Cookie, into redirected requests without validating if the redirect is cross-origin. This allows a server to redirect to a different origin and receive sensitive headers unintentionally, exposing confidential information. The issue occurs when authenticated requests use Http2Adapter with redirect following enabled (default). The problem is resolved in version 2.8.0.
Potential Impact
Sensitive headers such as Authorization, Cookie, and Proxy-Authorization may be sent to unintended, cross-origin destinations during HTTP/2 redirect following, potentially exposing sensitive authentication credentials to unauthorized servers. This could lead to unauthorized access or information disclosure. The vulnerability does not affect integrity or availability but has a high confidentiality impact.
Mitigation Recommendations
Upgrade Dio to version 2.8.0 or later, where this issue is fixed. Until then, consider disabling automatic redirect following in Http2Adapter for authenticated requests if feasible. No other vendor advisory information is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-29T21:13:24.032Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace610d2cdf04f6568909ff
Added to database: 10/13/2026, 16:49:17 UTC
Last enriched: 10/13/2026, 17:03:52 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.