CVE-2026-47265: CWE-346: Origin Validation Error in aio-libs aiohttp
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
AI Analysis
Technical Summary
CVE-2026-47265 describes a vulnerability in aio-libs aiohttp, an asynchronous HTTP client/server framework for Python. Before version 3.14.0, cookies specified with the `cookies` parameter on requests are sent even after a cross-origin redirect occurs. This can cause sensitive cookie data to be leaked if an attacker controls the redirect destination. The vulnerability is classified as CWE-346 (Origin Validation Error). The issue is fixed in aiohttp version 3.14.0. As a workaround, using the `Cookie` header in the `headers` parameter avoids the vulnerability.
Potential Impact
Sensitive cookie data may be leaked to an attacker who can control a redirect destination, potentially exposing session or authentication information. This could lead to unauthorized access or information disclosure. The CVSS 4.0 base score is 6.6 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, but high impact on confidentiality.
Mitigation Recommendations
Upgrade aiohttp to version 3.14.0 or later, where this issue is fixed. If upgrading is not possible, avoid using the `cookies` parameter on requests and instead set cookies via the `Cookie` header in the `headers` parameter, which is not vulnerable to this issue.
CVE-2026-47265: CWE-346: Origin Validation Error in aio-libs aiohttp
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
CVSS v4.0
Score 6.6medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47265 describes a vulnerability in aio-libs aiohttp, an asynchronous HTTP client/server framework for Python. Before version 3.14.0, cookies specified with the `cookies` parameter on requests are sent even after a cross-origin redirect occurs. This can cause sensitive cookie data to be leaked if an attacker controls the redirect destination. The vulnerability is classified as CWE-346 (Origin Validation Error). The issue is fixed in aiohttp version 3.14.0. As a workaround, using the `Cookie` header in the `headers` parameter avoids the vulnerability.
Potential Impact
Sensitive cookie data may be leaked to an attacker who can control a redirect destination, potentially exposing session or authentication information. This could lead to unauthorized access or information disclosure. The CVSS 4.0 base score is 6.6 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, but high impact on confidentiality.
Mitigation Recommendations
Upgrade aiohttp to version 3.14.0 or later, where this issue is fixed. If upgrading is not possible, avoid using the `cookies` parameter on requests and instead set cookies via the `Cookie` header in the `headers` parameter, which is not vulnerable to this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T23:03:37.229Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1f3494e29bf47b50fa2527
Added to database: 06/02/2026, 19:52:52 UTC
Last enriched: 06/10/2026, 11:16:58 UTC
Last updated: 07/19/2026, 17:26:49 UTC
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.