AIOHTTP versions before 3.14.4 improperly accept absolute‑form request targets. The visitor pattern causes the framework to set Request.scheme based on the attacker‑controlled scheme portion of the URL, rather than the protocol actually used by the connection. If an application relies on Request.scheme to decide whether a connection is encrypted or to perform other security checks, it can be tricked into treating an unencrypted HTTP connection as HTTPS or vice versa. This flaw is an instance of CWE‑807, an authentication bypass or escalation weakness.

The affected component is the aio-libs:aiohttp Python library. All releases lower than v3.14.4 are impacted; the problem is fixed in 3.14.4 and later releases.

The CVSS v3 score is 6.3, indicating moderate severity. EPSS data are not available, and the vulnerability is not listed in CISA KEV. An attacker who can send HTTP requests to an aiohttp‑based server may exploit the flaw by sending an absolute‑form URL that carries a forged scheme. The attack succeeds only if the application examines Request.scheme for security decisions, so the risk is limited to deployments that perform such checks. No privileged or privileged‑elevating conditions are required, and the vulnerability can be exercised remotely over the public interface.