Unrated severityNVD Advisory· Published Jan 28, 2026· Updated Mar 25, 2026
Libsoup: libsoup: credential leakage via http redirects
CVE-2026-1539
Description
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.
Affected products
1- Package: https://pypi.org/project/libsoup
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- access.redhat.com/security/cve/CVE-2026-1539mitrevdb-entryx_refsource_REDHAT
- gitlab.gnome.org/GNOME/libsoup/-/issues/489mitre
News mentions
0No linked articles in our index yet.