The vulnerability arises in the Elixir.Bandit.Pipeline module, specifically in the determine_scheme/2 function, which returns the client-supplied URI scheme verbatim without validating the transport's secure? flag. Attackers can exploit this by sending HTTP/1.1 absolute-form requests or HTTP/2 :scheme pseudo-headers over plaintext TCP connections, falsely indicating HTTPS. As a result, downstream components such as Plug.SSL may skip necessary HTTP to HTTPS redirects, cookies marked as secure may be sent over plaintext, audit logs may inaccurately record requests as secure, and CSRF or SameSite protections may be bypassed or misapplied. This affects bandit versions from 1.0.0 up to but not including 1.11.0.

An attacker can cause the server to treat an insecure plaintext HTTP connection as if it were secure HTTPS. This can lead to sensitive cookies being transmitted without encryption, security mechanisms that rely on connection security being bypassed or misapplied, and inaccurate logging of request security status. This undermines the integrity of security decisions based on the connection scheme, potentially exposing users to session hijacking or other attacks relying on secure transport assumptions.

Patch status is not yet confirmed — no official fix or remediation level is provided in the vendor advisory. Users should check the vendor's official advisory or repository for updates or patches addressing this issue. Until a fix is available, avoid relying solely on conn.scheme for security decisions and consider implementing additional verification of transport security at the application level.