@microsoft/kiota-http-fetchlibrary's RedirectHandler is intended to remove Authorization and Cookie headers on cross-origin redirects to prevent leaking sensitive tokens. However, in versions 1.0.0-preview.97 through 1.0.0-preview.101, the default scrubSensitiveHeaders callback deletes headers using case-sensitive keys (Authorization, Cookie) on a headers object whose keys have already been lower-cased by FetchRequestAdapter.getRequestFromRequestInformation. This results in no headers being removed, causing sensitive Authorization and Cookie headers to be sent to attacker-controlled hosts during redirects. This vulnerability is present in the default middleware chain and affects all kiota-generated TypeScript SDKs that use authentication providers setting the Authorization header. Version 1.0.0-preview.102 includes a fix for this issue.

Sensitive authentication headers such as Bearer tokens and Cookies can be unintentionally forwarded to attacker-controlled hosts during cross-origin HTTP redirects. This can lead to unauthorized access or token leakage. The vulnerability affects all kiota-generated TypeScript SDKs using the affected versions of @microsoft/kiota-http-fetchlibrary and authentication providers that set the Authorization header. There are no known exploits in the wild at this time.

Upgrade to @microsoft/kiota-http-fetchlibrary version 1.0.0-preview.102 or later, where the issue is patched. Until upgraded, be aware that the default middleware does not properly strip sensitive headers on redirects, so consider implementing custom middleware to correctly handle header scrubbing or avoid using affected versions in sensitive environments. Patch status is not explicitly confirmed in the vendor advisory, but the description states version 1.0.0-preview.102 patches the issue.