https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 06:27:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-216435 EUVD-2026-216435 https://cve.radiocsirt.org/vuln/euvd-2026-216435 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30846 <p>typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds.</p> <p>typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30846 https://cve.radiocsirt.org/vuln/ghsa-558p-m34m-vpmq <p><strong>Affected:</strong> npm: typed-rest-client</p> <p>### Impact Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.</p> <p>The flow of the vulnerability is as follows:</p> <p>1. Send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler` 2. The target host may return a redirection (3xx), with a link to a second host. 3. The next request will use the credentials to authenticate with the second host, by setting the `Authorization` header.</p> <p>The expected behavior is that the next request will *NOT* set the `Authorization` header.</p> <p>### Patches The problem was fixed on April 1st 2020.</p> <p>### Workarounds There is no workaround.</p> <p>### References This is similar to the following issues in nature: 1. [HTTP authentication leak in redirects](https://curl.haxx.se/docs/CVE-2018-1000007.html) - I used the same solution as CURL did. 2. [CVE-2018-1000007](https://nvd.nist.gov/vuln/detail/CVE-2018-1000007).</p> <p><strong>Affected:</strong> npm: typed-rest-client</p> <p>### Impact Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.</p> <p>The flow of the vulnerability is as follows:</p> <p>1. Send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler` 2. The target host may return a redirection (3xx), with a link to a second host. 3. The next request will use the credentials to authenticate with the second host, by setting the `Authorization` header.</p> <p>The expected behavior is that the next request will *NOT* set the `Authorization` header.</p> <p>### Patches The problem was fixed on April 1st 2020.</p> <p>### Workarounds There is no workaround.</p> <p>### References This is similar to the following issues in nature: 1. [HTTP authentication leak in redirects](https://curl.haxx.se/docs/CVE-2018-1000007.html) - I used the same solution as CURL did. 2. [CVE-2018-1000007](https://nvd.nist.gov/vuln/detail/CVE-2018-1000007).</p> https://cve.radiocsirt.org/vuln/ghsa-558p-m34m-vpmq https://cve.radiocsirt.org/vuln/gsd-2023-30846 gsd-2023-30846 https://cve.radiocsirt.org/vuln/gsd-2023-30846