CVE-2026-44503 Details
Description
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
A vulnerability exists in the RedirectHandler middleware of Microsoft Kiota libraries, including kiota-java, kiota-http-go, kiota-typescript, and kiota-dotnet. The issue arises in kiota-java version 1.9.0 and earlier, as well as in kiota-http-go versions prior to 1.5.5, kiota-typescript versions prior to 1.0.0-preview.100, and in kiota-dotnet versions prior to 1.22.0. When following 3xx redirects to a different host or scheme, the middleware fails to remove sensitive HTTP headers, such as Cookie, Proxy-Authorization, and all custom headers, except for the Authorization header, which is stripped. This flaw allows for the unintentional leakage of sensitive information to potentially malicious servers during cross-host redirects.
Users can update to kiota-java version 1.9.1, kiota-http-go version 1.5.5, kiota-typescript version 1.0.0-preview.100, or kiota-dotnet version 1.22.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft Kiota Java | All versions |
CPE
Remediation
| |
| Microsoft Kiota Abstractions | All versions |
CPE
Remediation
| |
| Microsoft Kiota HTTP Go | All versions |
CPE
Remediation
| |
| Microsoft Kiota TypeScript | All versions |
CPE
Remediation
| |
| Microsoft Kiota HTTP | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |