Description
@microsoft/kiota-http-fetchlibrary’s RedirectHandler is documented as stripping Authorization and Cookie from cross-origin redirect targets, but the default scrubSensitiveHeaders callback in RedirectHandlerOptions uses case-sensitive property deletion (delete headers.Authorization, delete headers.Cookie) on a headers object that FetchRequestAdapter.getRequestFromRequestInformation has already lower-cased.
Recommendation
Update the @microsoft/kiota-http-fetchlibrary package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0-preview.97, <= 1.0.0-preview.101
- Patched version(s): 1.0.0-preview.102
References
Could your website be exposed too?
SmartScanner can check your website for @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
- Papra HTTP redirect bypass can lead to SSRF via webhook delivery system - CVE-2026-48051
- Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
- Strapi may leak sensitive data via relational filtering due to lack of query sanitization - CVE-2026-27886
You might also like:
See something that needs correcting? Let us knowUpdated June 26, 2026