Authorization Header Exposure in urllib3
Summary
CVE-2018-25091: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). Affects urllib3 across 2 version ranges.
< 1.24.2
< adb358f8e06865406d1f05e581a16cbea2136fbc
Fixed in adb358f8e06865406d1f05e581a16cbea2136fbc. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2018-25091 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
urllib3 is a powerful HTTP client library for Python, widely used for making HTTP requests. It provides a high-level interface for sending HTTP requests, handling cookies, and managing connections. However, urllib3 versions before 1.24.2 are vulnerable to an authorization header exposure issue.
Vulnerability Detail
The vulnerability in urllib3 arises from its failure to remove the authorization HTTP header when following a cross-origin redirect. In other words, if a redirect occurs to a different host, port, or scheme, urllib3 does not remove the authorization header from the subsequent request. This can lead to the exposure of credentials in the authorization header to unintended hosts or the transmission of credentials in cleartext. This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2018-20060). The severity of this vulnerability is rated as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N with a score of 6.1.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
adb358f8e06865406d1f05e581a16cbea2136fbc
This is the first release that contains the fix.
pip install --upgrade "urllib3==adb358f8e06865406d1f05e581a16cbea2136fbc"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately feasible, a possible workaround is to manually remove the authorization header before making requests that may result in cross-origin redirects. Here's an example of how to achieve this using the requests library:
import requests
url = 'https://example.com'
headers = {'Authorization': 'Bearer my_token'}
response = requests.get(url, headers=headers, allow_redirects=False)
if response.status_code == 302:
del headers['Authorization']
response = requests.get(response.headers['Location'], headers=headers)
print(response.text)
Conclusion
The vulnerability in urllib3 versions before 1.24.2 allows for the exposure of credentials in the authorization header to unintended hosts or the transmission of credentials in cleartext. To mitigate this risk, it is highly recommended to upgrade urllib3 to version 1.24.2 or later. If immediate upgrading is not possible, manually removing the authorization header before requests that may result in cross-origin redirects can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
The vulnerability allows for the exposure of credentials in the authorization header to unintended hosts or the transmission of credentials in cleartext. This can potentially lead to unauthorized access to sensitive information or accounts.
urllib3 versions before 1.24.2 are affected by this vulnerability.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to promptly apply the recommended fix to mitigate any potential risks.
Yes, a possible workaround is to manually remove the authorization header before making requests that may result in cross-origin redirects. Please refer to the 'workaround' section for more details.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
