CVE-2026-85717: AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect because the Interceptors authentication path falls back to the client configuration after redirect handling clears the per-exchange realm. If the attacker-controlled target returns 401, the client can send Basic or Digest credentials or a Negotiate or NTLM token to that origin. Per-request realms are stripped correctly, and this issue is a residual bypass of the earlier cross-origin credential-stripping fixes. This issue is fixed in versions 2.16.1 and 3.0.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncHttpClientto a version that resolves this vulnerability.Fixed in 2.16.1 - Upgrade
Upgrade
AsyncHttpClientto a version that resolves this vulnerability.Fixed in 3.0.12
Event History
Frequently Asked Questions
Which applications are exposed to credential disclosure?
Applications using AsyncHttpClient 2.14.5 through 2.16.0 or 3.0.9 through 3.0.11 are exposed when they enable redirect following and configure a client-wide Realm. Applications using per-request realms are not affected by this bypass because those realms are stripped correctly on cross-origin redirects.
What must an attacker be able to do to trigger the leak?
The client must follow a redirect to an attacker-controlled cross-origin target. That target must return HTTP 401, which can cause the client to send Basic or Digest credentials, or a Negotiate or NTLM token, from the client-wide Realm to the attacker-controlled origin.
What should teams do if they cannot upgrade immediately?
Disable redirect following or avoid configuring credentials through a client-wide Realm. Use per-request realms instead, as they are stripped correctly during cross-origin redirects.
How can I remediate the issue?
Upgrade AsyncHttpClient to version 2.16.1 or later on the 2.x line, or version 3.0.12 or later on the 3.x line.