Perl HTTP::Tiny Forwards Credentials to Cross-Origin Redirects

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

HTTP::Tiny is a widely-used Perl library for making HTTP requests, and this vulnerability allows attackers to steal sensitive credentials through cross-origin redirect attacks. When a web server responds with a 3xx redirect status code, versions before 0.095 automatically follow the Location header while preserving the caller's original headers—including Authorization, Cookie, and Proxy-Authorization headers. An attacker controlling a redirect target can trick the application into sending these credentials to an arbitrary host, effectively exfiltrating authentication tokens and session cookies. This affects any Perl application using HTTP::Tiny for API calls, web scraping, or service-to-service communication, particularly those interacting with untrusted or compromised endpoints.

Casky's 233 matching skills leverage Claude's extended reasoning to identify this vulnerability pattern across TA0006 (Credential Access) techniques. Practitioners using Casky would see detections flagging unsafe redirect handling, credential leakage in HTTP headers, and cross-origin trust violations. The platform's MITRE ATT&CK mapping would highlight techniques like T1187 (Forced Authentication) and T1539 (Steal Web Session Cookie), helping teams understand how attackers chain redirect manipulation with credential harvesting. By analyzing code patterns, request flows, and header propagation logic, Casky surfaces the exact conditions where unvalidated redirects expose sensitive data—enabling practitioners to patch vulnerable code and implement origin validation before credentials are transmitted.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7017.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-7017

Casky has 233 skills that investigate the attack patterns behind CVE-2026-7017. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn