CVE-2026-91766

A flaw was found in PHP. When following a redirect, the built-in HTTP (Hypertext Transfer Protocol) stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious server capable of steering redirects can exploit this flaw to capture sensitive credentials intended only for the original destination.

This vulnerability is rated Moderate because PHP's HTTP stream wrapper can forward Authorization, Cookie, and Proxy-Authorization headers across cross-origin redirects, exposing credentials to an attacker-controlled redirect target. Attack complexity is elevated because the initial destination must issue a redirect that the client follows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid placing long-lived credentials in HTTP stream context headers when follow_location is enabled; prefer short-lived tokens and same-origin redirect expectations. Restrict outbound HTTP(S) destinations from PHP applications to trusted hosts.