Improper access control in aiohttp - CVE-2026-54276
Published: June 9, 2026
Vulnerability identifier: #VU133995
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54276
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in DigestAuthMiddleware when following a cross-origin redirect and handling an authentication challenge. A remote attacker can cause the client to follow a redirect to an attacker-controlled domain to disclose sensitive information.
Exploitation likely requires an open redirect or similar condition on the target domain, and the exposed digest may only enable credential recovery when weak cryptography or password reuse is involved.
Affected software
aiohttp
openEuler
python-aiohttp
python-aiohttp-debuginfo
python-aiohttp-debugsource
python-aiohttp-help
python3-aiohttp
openEuler
python-aiohttp
python-aiohttp-debuginfo
python-aiohttp-debugsource
python-aiohttp-help
python3-aiohttp
How to mitigate CVE-2026-54276
Install security update from vendor's website.
aiohttp - update to 3.14.1
python-aiohttp - update to 3.14.1-1
python-aiohttp-debuginfo - update to 3.14.1-1
python-aiohttp-debugsource - update to 3.14.1-1
python-aiohttp-help - update to 3.14.1-1
python3-aiohttp - update to 3.14.1-1
python-aiohttp - update to 3.14.1-1
python-aiohttp-debuginfo - update to 3.14.1-1
python-aiohttp-debugsource - update to 3.14.1-1
python-aiohttp-help - update to 3.14.1-1
python3-aiohttp - update to 3.14.1-1