Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107715— Mechanize sends credential headers to another host after an HTTP redirect

Quick assessment

Affected
sparklemotion mechanize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mechanize 库用于自动化与网站的交互。在 2.14.1 版本之前，Mechanize 会在 HTTP 重定向后将调用者提供的认证头部信息发送至不同的主机。具体而言，即使 方法会清除每个请求的头部信息， 仍会重新应用通过 设置的头部。此外，受保护的头部列表未排除 和 。攻击者若能控制重定向目标，则可捕获通过 或每请求头部参数提供的承载令牌（bearer tokens）或会话 cookie；但 和 不受此问题影响。该问题已在 2.14.1 版本中修复。

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107715

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mechanize sends credential headers to another host after an HTTP redirect
Source: CVE Program / CVE List V5
Vulnerability Description
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sparklemotion mechanize < 2.15.0 -

II. Public POCs for CVE-2026-107715

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107715

请登录查看更多情报信息。

Other References for CVE-2026-107715 (6)

Same Patch Batch · sparklemotion · 2026-10-08 · 3 CVEs total

CVE-2026-107399 6.8 MEDIUM Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-107714 5.9 MEDIUM Mechanize sends credential headers to a different scheme or port after a redirect

IV. Related Vulnerabilities

Same product: mechanize
Same vendor: sparklemotion
Same weakness: CWE-200

V. Comments for CVE-2026-107715

No comments yet

Leave a comment