Search: CVE-2026-34518

CVE-2026-34518 is a low-severity vulnerability in aiohttp versions prior to 3.13.4 where the Authorization header is improperly handled during redirects to a different origin. Specifically, while the Authorization header is dropped as intended, the Cookie and Proxy-Authorization headers are retained, potentially exposing sensitive information to unauthorized actors. This issue has been addressed in aiohttp version 3.13.4.