CVE-2026-102944 in cpp-httplib
Summary
by MITRE • 10/14/2026
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The cpp-httplib library serves as a widely utilized header-only HTTP and HTTPS client implementation within C++ applications, providing essential functionality for network communication including automatic handling of redirect responses. A significant security flaw was identified in versions prior to 0.51.0 regarding the behavior of the create_redirect_client function when processing specific HTTP redirection codes. The vulnerability stems from an inconsistent approach to header management during cross-origin redirects, where the library attempts to strip sensitive authentication headers but fails to remove session cookies, thereby creating a pathway for credential leakage across different domains or origins.
The technical root cause lies in how the detail::redirect internal function handles request copying for HTTP status codes 301 Moved Permanently, 302 Found, 307 Temporary Redirect, and 308 Permanent Redirect. While the implementation correctly removes headers such as Host, Proxy-Authorization, and Authorization to prevent credential leakage associated with these specific redirect types, it inadvertently preserves Cookie headers that were either supplied directly in the request or configured via default_headers_. This selective stripping creates a security gap where sensitive session identifiers remain attached to the outgoing request despite the change in origin. In contrast, HTTP status code 303 See Other is not affected by this flaw because its processing path explicitly clears all request headers before sending the subsequent request, ensuring no residual data from the original request is transmitted to the new target.
The operational impact of this vulnerability allows an attacker who controls a redirect response or possesses a privileged network position for non-HTTPS origins to intercept session cookies intended for the original origin. When a victim application using cpp-httplib follows such a maliciously crafted redirect, it automatically transmits its active session cookies to the attacker-controlled domain. This behavior violates the principle of least privilege and standard security expectations regarding cross-origin requests, potentially leading to severe consequences including account takeover, session hijacking, and unauthorized access to sensitive user data or application functionality protected by cookie-based authentication mechanisms.
This vulnerability is classified under CWE-613, which denotes Insufficient Session Expiration, as it relates to the improper handling of session identifiers during state transitions like redirects. It also aligns with ATT&CK technique T1583.002, Acquire Infrastructure: Domains, where attackers use domains to facilitate phishing or credential harvesting. The issue is effectively mitigated by upgrading cpp-httplib to version 0.51.0 or later, which corrects the header stripping logic to ensure that Cookie headers are removed alongside other sensitive authentication data during cross-origin redirects for all affected HTTP status codes. Developers relying on this library should verify their dependency versions and consider implementing additional client-side checks if upgrading is not immediately feasible, although such workarounds may be complex given the internal nature of the redirect handling mechanism.