Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107399— Mechanize sends credential headers to another origin after a meta refresh

Quick assessment

Affected
sparklemotion mechanize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mechanize 库用于自动化与网站的交互。在版本 2.14.1 之前，当启用 时， 方法未实施源信任边界（origin trust boundary）检查。如果某页面包含指向其他源（origin）的 meta refresh 指令，则通过 配置的请求头会被重新应用到该重定向请求中，从而导致攻击者若能控制爬取过程中的内容，即可捕获承载令牌（bearer tokens）或会话 cookie。默认配置不受此影响，因为 默认值为 false；且该风险仅局限于调用者提供的默认请求头。此问题已在版本 2.14.1 中得到修

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107399

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mechanize sends credential headers to another origin after a meta refresh
Source: CVE Program / CVE List V5
Vulnerability Description
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sparklemotion mechanize < 2.15.0 -

II. Public POCs for CVE-2026-107399

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107399

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-107399 (3)

Vendor Advisories for CVE-2026-107399 (1)

Vendor Pages for CVE-2026-107399 (1)

Same Patch Batch · sparklemotion · 2026-10-08 · 3 CVEs total

CVE-2026-107715 6.8 MEDIUM Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107714 5.9 MEDIUM Mechanize sends credential headers to a different scheme or port after a redirect

IV. Related Vulnerabilities

Same product: mechanize
Same vendor: sparklemotion
Same weakness: CWE-200

V. Comments for CVE-2026-107399

No comments yet

Leave a comment