CVE-2026-121554— cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

Quick assessment

Affected

silkimen cordova-plugin-advanced-http

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

cordova-plugin-advanced-http 插件（版本 3.3.1 及更早版本）存在信息泄露漏洞：该插件在跨域重定向过程中会转发显式设置的 Cookie 请求头，导致 Cookie 泄露给第三方主机。若攻击者能够控制重定向目标（例如通过开放重定向漏洞或提供恶意 URL），即可获取原始主机的会话 Cookie，进而劫持用户会话。

CVSS 5.9 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1586 · Compromise Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
silkimen	cordova-plugin-advanced-http	`1.5.0≤ 3.3.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

Source: CVE Program / CVE List V5

Vulnerability Description

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过发送数据的信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
silkimen	cordova-plugin-advanced-http	1.5.0 ~ 3.3.1	-

II. Public POCs for CVE-2026-121554

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121554

请登录查看更多情报信息。

Other References for CVE-2026-121554 (6)

https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/www/helpers.js#L376 technical-description
https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/src/ios/CordovaHttpPlugin.m#L88-L98 technical-description
https://github.com/silkimen/cordova-plugin-advanced-http product
https://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1 patch
https://github.com/silkimen/cordova-plugin-advanced-http/pull/549 issue-tracking patch
https://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121554

IV. Related Vulnerabilities

Same weakness: CWE-201