Skip to content
Heist/ feed
MediumFix available

`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

Type: advisorySource: OSV1 source record

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

Announced Source revision 1
Original source ↗

BIT-python-min-2026-15806

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-python-min-2026-15806

python-min

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
3.10.22

Source reference: /affected/0/ranges

3.11.17

Source reference: /affected/0/ranges

3.12.15

Source reference: /affected/0/ranges

3.13.16

Source reference: /affected/0/ranges

3.14.8

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.10.22"
          },
          {
            "introduced": "3.11.0"
          },
          {
            "fixed": "3.11.17"
          },
          {
            "introduced": "3.12.0"
          },
          {
            "fixed": "3.12.15"
          },
          {
            "introduced": "3.13.0"
          },
          {
            "fixed": "3.13.16"
          },
          {
            "introduced": "3.14.0"
          },
          {
            "fixed": "3.14.8"
          }
        ]
      }
    ],
    "package": {
      "name": "python-min",
      "purl": "pkg:bitnami/python-min",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V4",
        "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-15806.json"
    }
  }
]
Related CVEs
CVE-2026-15806

Source reference: /aliases

Publisher severity

medium

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-15806 · Medium

CPython

CVE-2026-15806 · Medium

libpython

CVE-2026-15806 · Medium

python

Event
#84211 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement