CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
| CWE | CWE-601 |
| Vendor | microsoft |
| Product | kiota-java |
| Ecosystems | |
| Industries | TechnologyEnterprise |
| Published | May 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for microsoft kiota-java
Be the first to know when new unknown vulnerabilities affecting microsoft kiota-java are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
microsoft / kiota-java
< 1.9.1
microsoft / Microsoft.Kiota.Abstractions
< 1.22.0
microsoft / github.com/microsoft/kiota-http-go
< 1.5.5
microsoft / kiota-typescript
< 1.0.0-preview.100
microsoft / microsoft-kiota-abstractions
< 1.9.1
microsoft / microsoft-kiota-http
< 1.9.9