CVE-2026-8368: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LWP::UserAgent (libwww-perl)to a version that resolves this vulnerability.Fixed in 6.83
Event History
Frequently Asked Questions
What conditions are required for credential disclosure?
An application must use an affected LWP::UserAgent version, supply Authorization or Proxy-Authorization headers, and follow a 3xx redirect. Disclosure occurs when that redirect changes the scheme, host, or port and points to an attacker-controlled destination.
Which credentials can be exposed?
Caller-supplied Authorization and Proxy-Authorization header values can be sent to the cross-origin redirect target. The issue does not affect Host or Cookie headers, which the redirect handler already strips.
How can I determine whether an application is affected?
Check whether it uses LWP::UserAgent from libwww-perl before version 6.83 and whether it makes requests with Authorization or Proxy-Authorization headers that may follow redirects. Review redirect behavior for destination changes in scheme, hostname, or port.
What can be done before upgrading?
Avoid automatically following redirects for requests that include Authorization or Proxy-Authorization headers, or ensure redirects cannot lead to untrusted origins. Do not send these headers on follow-up requests when the redirect changes scheme, host, or port.