PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8368 OALDERS CVE debrief

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.

Vendor
OALDERS
Product
LWP::UserAgent
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-19
Advisory published
2026-05-12
Advisory updated
2026-05-19

Who should care

Organizations running Perl applications that use LWP::UserAgent for HTTP requests with authentication, particularly those that may follow redirects to external or untrusted hosts. This includes web scraping tools, API clients, and automation scripts.

Technical summary

LWP::UserAgent in libwww-perl before version 6.83 fails to strip Authorization and Proxy-Authorization headers when following HTTP 3xx redirects. The redirect handler only removes Host and Cookie headers before issuing follow-up requests, leaving authentication credentials intact. This behavior persists across scheme changes (HTTP to HTTPS), host changes, and port changes. An attacker who can induce a redirect to a controlled host—through open redirect vulnerabilities, compromised legitimate sites, or man-in-the-middle attacks—can capture these credentials. The vulnerability affects any Perl application using LWP::UserAgent with explicit authentication headers that follows redirects. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact.

Defensive priority

medium

Recommended defensive actions

  • Upgrade to LWP::UserAgent version 6.83 or later to remediate the credential disclosure vulnerability.
  • Review applications using LWP::UserAgent for any reliance on custom redirect handling that may need adjustment after upgrading.
  • Audit HTTP client configurations to ensure sensitive headers are not inadvertently preserved across redirects in other libraries.

Evidence notes

The vulnerability was disclosed on 2026-05-12 and modified on 2026-05-19. The fix is available in libwww-perl 6.83. The issue was discussed in oss-security and addressed via GitHub pull requests.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8368 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8368

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8368 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8368

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://github.com/libwww-perl/libwww-perl/pull/284

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://github.com/libwww-perl/libwww-perl/pull/512

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/OALDERS/libwww-perl-6.83/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.