Bandit does not properly validate the authority component of an HTTP/1 request‑target, allowing an unauthenticated remote actor to set conn.host and conn.port to values that violate RFC 3986. The value taken from the request target overrides a valid Host header, and Bandit passes these unchecked values to the application. If the application builds absolute URLs from conn.host, it can emit links or URLs that point to attacker‑chosen domains or ports, potentially enabling phishing or link‑smuggling attacks. The vulnerability does not affect basic message framing and contains no injection of CR/LF into the target host.

The issue exists in Bandit version 0.6.0 through 1.12.x. Versions 1.13.0 and later contain the fix. The affected product is the open‑source Bandit framework maintained by mtrudel.

The CVSS score of 6.9 denotes moderate severity, and the EPSS score of less than 1% indicates a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw simply by sending an HTTP/1 request with an absolute or authority‑form target such as GET http://evil.example@good.example/…; no authentication is required. The risk arises only if the receiving application uses conn.host/conn.port to construct absolute URLs or to initiate outbound connections, so the impact is limited to those scenarios.