The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Juneau | unaffected |
|
||||||
| Apache Software Foundation | Apache Juneau | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 05 Nov 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves. | |
| Title | Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects | |
| Weaknesses | CWE-522 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-11-05T11:53:52.274Z
Reserved: 2026-08-10T21:14:20.996Z
Link: CVE-2026-73116
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-05T12:17:51.333
Modified: 2026-11-05T12:17:51.333
Link: CVE-2026-73116
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-522
Insufficiently Protected Credentials