CVE-2026-48595 Details

A vulnerability in the Elixir Tesla library, specifically in versions 1.4.0 prior to 1.18.3, has been identified. The issue arises in the FollowRedirects middleware, which improperly handles the case sensitivity of HTTP headers. This flaw allows for the leakage of authorization credentials to third-party origins during cross-origin redirects. The middleware is supposed to strip sensitive headers like Authorization and Host when following redirects to different domains. However, it uses a case-sensitive comparison against a lowercase filter list, failing to recognize headers set with their canonical casing as defined by the RFC standards. As a result, headers such as 'Authorization' are not filtered out and can be forwarded to the redirect destination, potentially exposing bearer tokens or other sensitive information. An attacker who can influence the Location response seen by the client can exploit this vulnerability, leading to unauthorized access to the leaked credentials.

Update to Tesla version 1.18.3 or later. If an immediate upgrade is not possible, normalize all header keys to lowercase before sending them, using 'authorization' instead of 'Authorization'.