Skip to content
Threat Feed

Product

Microsoft-Kiota-Http

1 brief RSS
high advisory

Kiota RedirectHandler Leaks Sensitive Headers on Cross-Origin Redirects

The RedirectHandler middleware in multiple Kiota libraries fails to strip sensitive HTTP headers (Cookie, Proxy-Authorization, and custom headers) when following 3xx redirects to a different host or scheme, potentially leading to session hijacking, corporate proxy credential theft, and API key theft.

kiota-java +8 header-injection credential-access cloud
3r 1t