CVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018 | Hacker News - But Better

CVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018 daubois.dev

PHP's http:// stream wrapper sent Authorization, Cookie and Proxy-Authorization to any host a redirect pointed at, the bug curl fixed in 2018.

4 points•amvalex•6 days ago•1 comment•

#fixed #curl #redirect #curl fixed #cve #php #leak #credential

1 comment

amvalex6 days ago

Author here, I wrote the fix with Jakub Zelenka. Happy to take any question you may have about this CVE.

Read the full thread on Hacker News →

Related stories

CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682)github.com
Hacker News · 1 points · 6 days ago
Porting Extensions to PHP 8seidengroup.com
Lobsters · 5 points · almost 6 years ago
TCP SACK PANIC - Kernel vulnerabilities - CVE-2019-11477, CVE-2019-11478 & CVE-2019-11479access.redhat.com
Lobsters · 1 points · over 7 years ago
PHP 4.1.1 Simulator: A jsfiddle-style edit-run page for 2001 era PHPsimphp.infinitefun.com
Hacker News · 1 points · 4 days ago
A free, keyless MCP Server for CVE data and per-CVE internet Exposure
Hacker News · 1 points · 4 days ago
Typed properties in PHPstitcher.io
Lobsters · 7 points · over 7 years ago