Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107714— Mechanize sends credential headers to a different scheme or port after a redirect

Quick assessment

Affected
sparklemotion mechanize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mechanize 库用于自动化与网站的交互。在版本 2.14.1 之前， 方法在主机名匹配时，会将重定向视为同源（same-origin），但未一致地比较协议（scheme）和端口（port）。这可能导致以下安全问题： 在同一主机名下从 HTTPS 重定向到 HTTP 时，会明文发送 （授权）和 （Cookie）头部信息； 在同一主机名下重定向到不同端口时，可能会将调用方提供的 头部发送到另一个服务。 需要注意的是， 中的 Cookie 是独立作用域的，因此该漏洞不影响 Cookie 的完整性或可用性。但该漏洞会

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107714

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mechanize sends credential headers to a different scheme or port after a redirect
Source: CVE Program / CVE List V5
Vulnerability Description
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sparklemotion mechanize < 2.15.0 -

II. Public POCs for CVE-2026-107714

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107714

请登录查看更多情报信息。

Other References for CVE-2026-107714 (5)

Same Patch Batch · sparklemotion · 2026-10-08 · 3 CVEs total

CVE-2026-107399 6.8 MEDIUM Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-107715 6.8 MEDIUM Mechanize sends credential headers to another host after an HTTP redirect

IV. Related Vulnerabilities

Same product: mechanize
Same vendor: sparklemotion
Same weakness: CWE-200

V. Comments for CVE-2026-107714

No comments yet

Leave a comment