PHP Fixed a Bug That Could Send Your Login Credentials to the Wrong Server
PHP patched CVE-2026-91766, which could forward login credentials and cookies to an unintended redirect host.
52
CVE-2026-91766
PHP HTTP Stream Wrapper Leaks Credentials on Redirects
- CVSS 3.1
- 5.9 medium
- EPSS
- <1%p21
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
PHP’s HTTP stream wrapper forwards user-supplied Authorization, Cookie, and Proxy-Authorization headers when it follows a redirect, including to a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer that redirect receives credentials meant only for the original origin. The impact is disclosure of those credentials (CWE-200 and CWE-522); integrity and availability are not affected, and CVSS 3.1 rates it 5.9 (medium) with high attack complexity. Any PHP application using the http stream wrapper with those headers and redirect following is potentially affected; the advisory does not list versions. There is no known public proof of concept and the issue is not in CISA KEV. This is the same class of issue libcurl fixed in 7.58.0 (CVE-2018-1000007).
What to do: Apply the PHP security update that fixes CVE-2026-91766 once your distribution or php.net publishes it; the advisory data does not name a version, so confirm the fix against the vendor advisory rather than guessing a release. Until then, do not send Authorization, Cookie, or Proxy-Authorization through PHP HTTP stream wrappers when a redirect could change host, port, or scheme from HTTPS to HTTP, and review apps that follow redirects with those headers. No public exploit is known; still treat unexpected credential use on a different origin as suspicious.
| Product | Affected |
|---|---|
| The PHP Group PHP | — |
Estimated exposure
massTens of millions of PHP installations potentially include the stream wrapper; the share that send credentials across redirects is unknown and smaller — Public web surveys (W3Techs-class) have long reported PHP on a large majority of sites with a known server-side language, on the order of tens of millions of installations; only apps that send those headers and follow cross-origin or…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).