CVE-2026-54276 is a medium severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Before version 3.14.1, the DigestAuthMiddleware component could send an authentication response after following a cross-origin redirect. Exploitation likely depends on the presence of an open redirect vulnerability on the target domain. The attacker receives the digest authentication response, which may expose user credentials only if cryptographic protections are weak or if passwords are reused. This vulnerability is addressed in aiohttp version 3.14.1.

An attacker exploiting this vulnerability can obtain digest authentication responses after cross-origin redirects, potentially exposing sensitive authentication information. However, successful credential compromise depends on weak cryptography or password reuse by the user. There is no indication of active exploitation in the wild.

Upgrade aiohttp to version 3.14.1 or later, where this vulnerability is fixed. No other mitigations are indicated or required by the vendor advisory.