microsoft kiota-typescript up to 1.0.0-prev Request Header case sensitivity

Summaryinfo

A vulnerability, which was classified as problematic, has been found in microsoft kiota-typescript up to 1.0.0-prev. Affected by this vulnerability is an unknown functionality of the component Request Header Handler. Performing a manipulation results in case sensitivity. This vulnerability is identified as CVE-2026-49336. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in microsoft kiota-typescript up to 1.0.0-prev. It has been classified as problematic. This affects an unknown functionality of the component Request Header Handler. The manipulation with an unknown input leads to a case sensitivity vulnerability. CWE is classifying the issue as CWE-178. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. This is going to have an impact on confidentiality. The summary by CVE is:

@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Cookie` from cross-origin redirect targets, but the default `scrubSensitiveHeaders` callback in `RedirectHandlerOptions` uses case-sensitive property deletion (`delete headers.Authorization`, `delete headers.Cookie`) on a headers object that `FetchRequestAdapter.getRequestFromRequestInformation` has already lower-cased. The delete therefore targets keys that do not exist, the scrub is a no-op, and any Bearer token or Cookie attached by a kiota-generated SDK is forwarded to an attacker-controlled host across a 30x redirect. This is reachable in the default middleware chain (`MiddlewareFactory.getDefaultMiddlewares`) with no custom configuration, and applies to every kiota-generated TypeScript SDK that uses `BaseBearerTokenAuthenticationProvider` or any other authentication provider that sets the `Authorization` request header. Version 1.0.0-preview.102 patches the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-49336 since 05/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/20/2026).

It is declared as proof-of-concept.

Upgrading to version 1.0.0-preview.102 eliminates this vulnerability. Applying the patch 09f8bd9b34d68bf412a9b78f6ca7e7961ef14974 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38061). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• microsoft

Name

• kiota-typescript

Version

• 1.0.0-prev

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/kiota-typescript/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion