cordova-plugin-advanced-http version 1.5.0 through 3.3.1 contains an information‑disclosure flaw that results in leaking HTTP cookies to third‑party hosts. The JavaScript layer emits a Cookie header as a normal request header, and when the request is redirected to another host—either by an open redirect or an attacker‑controlled redirect—the underlying iOS and Android networking stacks forward that header unchanged. This allows a malicious domain that receives the redirect to capture session cookies and hijack user sessions.

The vulnerability affects Cordova applications that incorporate Silkimen’s cordova‑plugin‑advanced‑http between versions 1.5.0 and 3.3.1, on both iOS and Android platforms. Anyone who has deployed a mobile app using this plugin within the stated version range is potentially exposed.

With a CVSS score of 8.2 the risk is classified as high. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the attack path is straightforward: a redirect to an attacker‑controlled domain will pass the Cookie header unfiltered. An attacker who can influence or observe redirect URLs can acquire user session identifiers with little effort, especially in apps that rely on third‑party services or that lack strict redirect validation.