AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

HIGH 7.5CVE-2026-47265 · GHSA-hg6j-4rv6-33pg · PYSEC-2026-2105 · Published 02/06/2026 · updated 21/07/2026

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.14.0`	`3.14.0`
aiohttp aiohttp	`< 3.14.0`	`3.14.0`

Description

Summary

Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.

Impact

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.

Workaround

If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

References

aio-libs/aiohttp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-47265 · ADVISORY
aio-libs/aiohttp commit f54c408 · WEB
aio-libs/aiohttp · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free