Insufficiently protected credentials in scrapy - #VU162975
Published: November 9, 2026
Vulnerability identifier: #VU162975
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to steal HTTP authentication credentials from requests made by Scrapy.
The vulnerability exists due to Scrapy's HttpAuthMiddleware restoring credentials from retained http_user and http_pass request metadata after cross-domain redirects when http_auth_domain is unset. An unauthenticated remote attacker can make a website visited by the crawler redirect a credential-bearing request to an attacker-controlled host, causing Scrapy to send the credentials to that host.
Affected software
scrapy
Remediation
Install security update from vendor's website.
scrapy - update to 2.20.0