The vulnerability causes the aiohttp client to retain Cookie and Proxy-Authorization headers when automatically following a redirect to a different origin, while correctly dropping the Authorization header. Because the cookie and proxy authentication tokens are still sent to the new domain, an attacker who controls that domain can receive credentials originally intended for a different server. This results in the confidential exposure of session data or proxy authorisation, potentially allowing session hijacking or unauthorized proxy use. The weakness is an information exposure (CWE-200) compounded by an improper authentication handling (CWE-497), and the NVD data lists a placeholder CWE indication (NVD-CWE-noinfo) for the vulnerability.

The aio-libs:aiohttp framework, versions earlier than 3.13.4, is affected. Updating to at least 3.13.4 removes the behaviour that causes the header leakage.

The stated CVSS score is 2.7, indicating a low‑impact vulnerability. The EPSS score is less than 1%, signifying a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker coaxing the aiohttp client to follow a cross‑origin redirect to a malicious domain; the client will then transmit the retained Cookie and Proxy-Authorization headers to that domain, exposing the credentials. Because the flaw merely leaks headers and requires a redirect, exploitation is limited to environments where the client automatically follows redirects and the attacker can control the redirect target.