https://seclists.org/oss-sec/2026/q3/514: CPython [CVE-2026-15806] urllib.quest.HTTPPasswordMgr cdentials for one URL scheme sent over another scheme
Published Aug 18, 2026
·Updated
Affected Software
1 affected component
CPython
The attacker would need to redirect or downgrade a client to plain HTTP, such as through an HTTPS-to-HTTP redirect or an on-path position. In that situation, credentials originally registered for an HTTPS URL could be sent in cleartext.
Applications using urllib.request.HTTPPasswordMgr, HTTPPasswordMgrWithDefaultRealm, or HTTPPasswordMgrWithPriorAuth to store credentials for URLs are affected. The issue occurs when requests to the same host are made using a different URL scheme than the one used when credentials were registered.
No. Credentials registered for an HTTP URL could also be sent on requests to the same host over HTTPS; the vulnerable credential matching did not distinguish between schemes.