CVE-2026-91766 PHP Group CVE debrief

Who should care

Defenders and administrators of systems that use the http:// stream wrapper should assess their exposure and take steps to mitigate the vulnerability. They should prioritize verifying and mitigating the impact of this vulnerability on systems that use the affected functionality. Operators, platform administrators, and security teams should review configurations to prevent forwarding of sensitive headers and monitor for potential misuse of credentials by

Why it matters

CVE-2026-91766 is a medium-severity vulnerability in the http:// stream wrapper that can lead to credential exposure when following redirects. Defenders should prioritize verifying and mitigating the impact of this vulnerability on systems that use the affected functionality.

• Servers that can steer redirects may receive credentials meant for the original origin.
• Defenders should verify configurations to prevent forwarding of sensitive headers.
• Systems using the http:// stream wrapper may be vulnerable to credential exposure.

Technical summary

The http:// stream wrapper forwards user-supplied Authorization, Cookie, and Proxy-Authorization headers unchanged when following redirects, even across different hosts, ports, or protocols. This can lead to credential exposure when redirects are steered by servers. The vulnerability affects systems that use the http:// stream wrapper and allows servers that can steer redirects to receive credentials meant for the original origin. Defenders should prioritize verifying and mitigating the impact of this vulnerability on systems that use the affected functionality.

Defensive priority

Defenders should prioritize verifying and mitigating the impact of this vulnerability on systems that use the affected functionality.

Recommended defensive actions

• Verify that systems using the http:// stream wrapper are configured to handle redirects securely.
• Review and update configurations to prevent forwarding of sensitive headers.
• Monitor for potential misuse of credentials by servers that can steer redirects.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from other sources may be necessary to fully understand the issue. The http:// stream wrapper's behavior of forwarding sensitive headers unchanged when following redirects can lead to credential exposure. Defenders should verify configurations to prevent forwarding of sensitive headers. Systems using the http:// stream wrapper may be vulnerable to credential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.