CVE-2026-8368: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

Published May 12, 2026
·
Updated

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

Affected Software

5 affected componentsFixes available
cpan/libwww-perl<6.83
Microsoft azl3 perl-libwww-perl 6.72-1
IBM AIX<=7.2
IBM AIX<=7.3
IBM PowerVM VIOS<=4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade LWP::UserAgent (libwww-perl) to a version that resolves this vulnerability.

    Fixed in 6.83

Event History

May 12, 2026
CVE Published
via MITRE·02:01 PM
Data Sourced
via MITRE·02:01 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
May 17, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:01 AM
DescriptionSeverity
Aug 15, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What conditions are required for credential disclosure?

An application must use an affected LWP::UserAgent version, supply Authorization or Proxy-Authorization headers, and follow a 3xx redirect. Disclosure occurs when that redirect changes the scheme, host, or port and points to an attacker-controlled destination.

2

Which credentials can be exposed?

Caller-supplied Authorization and Proxy-Authorization header values can be sent to the cross-origin redirect target. The issue does not affect Host or Cookie headers, which the redirect handler already strips.

3

How can I determine whether an application is affected?

Check whether it uses LWP::UserAgent from libwww-perl before version 6.83 and whether it makes requests with Authorization or Proxy-Authorization headers that may follow redirects. Review redirect behavior for destination changes in scheme, hostname, or port.

4

What can be done before upgrading?

Avoid automatically following redirects for requests that include Authorization or Proxy-Authorization headers, or ensure redirects cannot lead to untrusted origins. Do not send these headers on follow-up requests when the redirect changes scheme, host, or port.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203