PHP Fixed a Bug That Could Send Your Login Credentials to the Wrong Server
PHP patched CVE-2026-91766, which could forward login credentials and cookies to an unintended redirect host.
PHP fixed CVE-2026-91766, also tracked as GHSA-fpwc-w8rq-cr92, a moderate flaw in its HTTP stream wrapper. When code using file_get_contents(), fopen(), readfile(), or similar functions follows a redirect, vulnerable releases can forward Authorization, Cookie, and Proxy-Authorization headers to another scheme, host, or port, including an attacker-controlled server. The issue resembles an older libcurl credential-forwarding bug. Supported PHP 8 branches received the fix, and applications should avoid attaching reusable credentials to untrusted URLs.
- CVE-2026-91766 can leak Authorization, Cookie, and Proxy-Authorization headers
- Affects PHP HTTP and HTTPS stream wrappers that follow redirects
- Cross-origin includes a different host, port, or HTTPS-to-HTTP downgrade
- Rated moderate; supported PHP 8 branches contain the fix
- CVEs
- CVE-2026-91766
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91766 | PHP HTTP Stream Wrapper Leaks Credentials on Redirects | 5.9 | <1% | PoC |
From the original article
2 min read at cybersecuritynews.com
PHP has fixed a security flaw that could expose login credentials, cookies, and proxy authentication data to an unintended server during HTTP redirects. The vulnerability, tracked as CVE-2026-91766 and GHSA-fpwc-w8rq-cr92, affects PHP’s HTTP stream wrapper and has been rated as moderate severity. The issue occurs when a PHP application uses the http:// or https:// stream […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.