CVE-2026-49853

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote attacker to gain unauthorized access to a user's credentials, leading to information disclosure.

This is an information disclosure flaw in the Tornado SimpleAsyncHTTPClient where sensitive authentication credentials can be inadvertently exposed. When an application using SimpleAsyncHTTPClient follows a 3xx redirect to a different origin (scheme, host, or port), Authorization and other authentication headers are not cleared, potentially leaking them to an untrusted destination. This could lead to unauthorized access to resources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications utilizing Tornado's SimpleAsyncHTTPClient can mitigate this issue by explicitly disabling automatic redirection following. This can be achieved by setting follow_redirects=False when making HTTP requests. Manually handling redirects allows applications to ensure sensitive headers are not inadvertently sent to unintended origins. Disabling automatic redirects may alter application behavior that relies on this feature.