CVE-2026-8368 Details
Description
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.
A vulnerability exists in LWP::UserAgent versions prior to 6.83 for Perl, where Authorization and Proxy-Authorization headers are improperly forwarded during cross-origin redirects. This flaw allows credentials to be sent to an attacker-controlled host, potentially leading to unauthorized access. The issue arises because the redirect handler only removes the Host and Cookie headers, leaving sensitive authorization information intact.
Users can upgrade to LWP::UserAgent version 6.83 or later, where this vulnerability has been addressed. Instructions for upgrading can be found on MetaCPAN.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch | CPANSec | Source CodeVendor |
| https://github.com/libwww-perl/libwww-perl/pull/284 | CPANSec | Issue TrackingVendor |
| https://github.com/libwww-perl/libwww-perl/pull/512 | CPANSec | Issue TrackingVendor |
| https://metacpan.org/release/OALDERS/libwww-perl-6.83/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/12/7 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| LWP::UserAgent | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CVE |
| May 12, 2026 | New CVE Received | CPANSec |