PT-2026-45838 · Tesla · Tesla
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
tesla versions 1.4.0 through 1.18.2
Description
Improper handling of case sensitivity in the
Tesla.Middleware.FollowRedirects middleware allows credential leakage to third-party origins during cross-origin redirects. The system uses a case-sensitive string comparison against a lowercase filter list containing authorization and host to strip security-sensitive headers. However, because HTTP header names are case-insensitive per RFC 7230 and Tesla preserves header keys verbatim, headers using canonical casing, such as Authorization, do not match the lowercase filter and are forwarded to the redirect destination. An attacker capable of influencing a Location: response can capture bearer tokens or other authorization material.Recommendations
Update to version 1.18.3.
Normalize all header keys to lowercase before passing them to the software, specifically using
authorization instead of Authorization when setting headers via Tesla.put header/3 or Tesla.Middleware.Headers.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tesla