The vulnerability in aiohttp (an asynchronous HTTP client/server framework for Python) involves improper origin validation related to cookie handling on redirects. Specifically, when cookies are set using the `cookies` parameter on requests, these cookies are sent even after a cross-origin redirect, potentially exposing sensitive cookie data to an attacker controlling the redirect. This issue is identified as CWE-346 (Origin Validation Error). The vulnerability is fixed in aiohttp version 3.14.0. As a workaround, using the `Cookie` header directly in the `headers` parameter avoids the vulnerability.

If exploited, sensitive cookie data may be leaked to an attacker who can control a redirect, potentially leading to unauthorized access or session hijacking. The vulnerability does not require user interaction or privileges and can be triggered remotely. The CVSS 4.0 base score is 6.6 (medium severity), reflecting network attack vector, low attack complexity, and high impact on confidentiality.

Upgrade aiohttp to version 3.14.0 or later, where this issue is patched. If upgrading is not possible, avoid using the `cookies` parameter on requests and instead set cookies via the `Cookie` header in the `headers` parameter, which is not vulnerable. No other vendor advisory or patch information is provided, so check official aiohttp release notes for confirmation.