CVE-2026-121554: cordova-plugin-advanced-http through 3.3.1 Cookie Leak via Cross-Origin Redirects

Published Nov 3, 2026

Updated

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.

Other sources

cordova-plugin-advanced-http through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts by forwarding an explicitly set Cookie header across cross-origin redirects. Attackers controlling a redirect target, via an open redirect or attacker-supplied URL, can receive the original host's session cookies and hijack user sessions.

— MITRE

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to session-cookie theft?

Applications using cordova-plugin-advanced-http versions 1.5.0 through 3.3.1 are exposed when they make requests that can be redirected across origins. The impact is greatest where redirects can be influenced by an attacker or lead through an open redirect.

What does an attacker need to exploit this issue?

An attacker needs a request path that redirects from the original host to a host they control, such as through an open redirect or an attacker-supplied URL. No credentials or user interaction are required according to the provided vector.

How can I determine whether a request is affected?

Look for requests made through the plugin where a Cookie header is constructed from the cookie jar and then a redirect reaches a different host. If the redirected request sends the original host's Cookie header to that new host, session cookies may already be exposed.

CVE-2026-121554: cordova-plugin-advanced-http through 3.3.1 Cookie Leak via Cross-Origin Redirects

Other sources

Event History

Frequently Asked Questions

Which applications are exposed to session-cookie theft?

What does an attacker need to exploit this issue?

How can I determine whether a request is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to session-cookie theft?

What does an attacker need to exploit this issue?

How can I determine whether a request is affected?