CVE-2026-73116
Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
| CWE | CWE-522 |
| Vendor | apache software foundation |
| Product | apache juneau |
| Published | Nov 5, 2026 |
Get instant alerts for apache software foundation apache juneau
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache juneau are published — delivered to Slack, Telegram or Discord.