CVE-2026-54276 is an information exposure vulnerability in aio-libs aiohttp's DigestAuthMiddleware prior to version 3.14.1. The middleware can send an authentication response after following a cross-origin redirect, potentially allowing an attacker to obtain the digest authentication response. Exploitation likely requires an open redirect vulnerability on the target domain. The attacker only receives the digest, so credential compromise depends on weak cryptography or password reuse. This issue is resolved in aiohttp 3.14.1.

An attacker able to exploit this vulnerability could receive digest authentication responses after a cross-origin redirect, potentially exposing user credentials. However, successful exploitation requires an open redirect on the target domain and weak cryptographic protections or password reuse by the user. The impact is limited to information disclosure of authentication data.

Upgrade aiohttp to version 3.14.1 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed fixed in 3.14.1.