CVE-2026-121554
cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.
| CWE | CWE-201 |
| Vendor | silkimen |
| Product | cordova-plugin-advanced-http |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for silkimen cordova-plugin-advanced-http
Be the first to know when new medium vulnerabilities affecting silkimen cordova-plugin-advanced-http are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
silkimen / cordova-plugin-advanced-http
1.5.0 ≤ 3.3.1
References
github.com: https://github.com/silkimen/cordova-plugin-advanced-http/pull/549 github.com: https://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1 github.com: https://github.com/silkimen/cordova-plugin-advanced-http github.com: https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/www/helpers.js#L376 github.com: https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/src/ios/CordovaHttpPlugin.m#L88-L98 vulncheck.com: https://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects
Credits
Giacomo Balli