CVE-2026-107715: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in sparklemotion mechanize

The Mechanize library versions before 2.14.1 improperly handle HTTP redirects by reapplying caller-supplied credential headers such as bearer tokens or session cookies to a different host after a redirect. This occurs because Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers. The protected header lists omit Proxy-Authorization and Cookie2, which contributes to the exposure. An attacker controlling the redirect target can capture these sensitive headers. The Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected by this issue. The vulnerability is resolved in version 2.14.1.

An attacker who controls the redirect target can capture sensitive authentication credentials such as bearer tokens or session cookies supplied via request headers. This exposure can lead to unauthorized access to user sessions or resources. The vulnerability does not impact Mechanize's cookie jar or HTTP authentication store, limiting the scope to headers explicitly set by the caller. The CVSS v3.1 score is 6.8 (medium severity) with network attack vector, high confidentiality impact, no integrity or availability impact, and high complexity required.

Upgrade to Mechanize version 2.14.1 or later, where this issue is fixed. No other mitigation is necessary as the fix addresses the improper header handling during redirects.