Python aiohttp: Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. (CVE-2026-54276)

The python-aiohttp asynchronous HTTP framework contains a vulnerability in DigestAuthMiddleware in versions prior to 3.14.1. Specifically, after following a cross-origin redirect, the middleware can send an authentication response, potentially exposing digest authentication data. Exploitation likely requires an open redirect vulnerability on the target domain. The attacker gains only the digest response, which may not directly reveal credentials unless weak cryptography or password reuse is present. This vulnerability is addressed in aiohttp version 3.14.1.

An attacker exploiting this vulnerability could obtain digest authentication responses after a cross-origin redirect, potentially exposing user credentials if weak cryptography or password reuse exists. The vulnerability does not directly allow credential compromise without these additional factors. There is no indication of active exploitation in the wild.

Upgrade python-aiohttp to version 3.14.1 or later, where this vulnerability is fixed. No other specific mitigations are indicated.