PT-2026-40045 · Cpan · Lwp::Useragent

Kai Aizen · Published 2026-05-12 · Updated 2026-05-19 · CVE-2026-8368

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LWP::UserAgent versions prior to 6.83

Description LWP::UserAgent leaks Authorization and Proxy-Authorization headers during cross-origin redirects. When a 3xx response is received, the redirect handler only removes the Host and Cookie headers before the subsequent request. Consequently, caller-supplied Authorization and Proxy-Authorization headers are transmitted unchanged to the redirect target, even if the scheme, host, or port changes. This allows a redirect to an attacker-controlled host to disclose the caller's credentials.

Recommendations Update to version 6.83 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-8368

ECHO-353C-16D7-9C47

OPENSUSE-SU-2026:10781-1

Affected Products

Lwp::Useragent

References · 16

• https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch · Patch
• https://cve.org/CVERecord?id=CVE-2026-8368 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8368 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10781-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8368 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8368 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8368 · Vendor Advisory
• https://github.com/libwww-perl/libwww-perl/pull/284 · Note
• https://github.com/libwww-perl/libwww-perl/pull/512 · Note
• http://openwall.com/lists/oss-security/2026/05/12/7 · Note
• https://suse.com/security/cve/CVE-2026-8368 · Note
• https://lists.security.metacpan.org/cve-announce/msg/39974665 · Note
• https://twitter.com/oss_security/status/2055155332364546183 · Twitter Post
• https://t.me/cveNotify/164078 · Telegram Post