CVE-2026-44503Published

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-44503

Published

kiota-java

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "kiota-java",
                    "versions": [
                        {
                            "version": "< 1.9.1",
                            "status": "affected"
                        }
                    ]
                }

Microsoft.Kiota.Abstractions

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "Microsoft.Kiota.Abstractions",
                    "versions": [
                        {
                            "version": "< 1.22.0",
                            "status": "affected"
                        }
                    ]
                }

github.com/microsoft/kiota-http-go

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "github.com/microsoft/kiota-http-go",
                    "versions": [
                        {
                            "version": "< 1.5.5",
                            "status": "affected"
                        }
                    ]
                }

kiota-typescript

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "kiota-typescript",
                    "versions": [
                        {
                            "version": "< 1.0.0-preview.100",
                            "status": "affected"
                        }
                    ]
                }

microsoft-kiota-abstractions

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "microsoft-kiota-abstractions",
                    "versions": [
                        {
                            "version": "< 1.9.1",
                            "status": "affected"
                        }
                    ]
                }

microsoft-kiota-http

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "microsoft-kiota-http",
                    "versions": [
                        {
                            "version": "< 1.9.9",
                            "status": "affected"
                        }
                    ]
                }