CVE-2026-73116
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient…
- Risk score
- 65/100
- CVSS
- 10.0 v4.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, C…
- Affected
- See advisory
- Fix
- Upgrade the product to 9.2.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
Last activity 5 Nov 2026. Patch Forecast updates every hour.