AIOHTTP versions older than 3.14.0 allow a vulnerability where cookies supplied through the per‑request "cookies" parameter are transmitted after following a cross‑origin HTTP redirect. Attackers who can influence the redirect URL can therefore receive the requester's sensitive cookie data in a new origin, leaking confidential information. This flaw is classified as CWE‑346, indicating that output redirection is improperly controlled, leading to unintended information disclosure.

The issue affects the aio-libs AIOHTTP framework for Python and asyncio. All releases prior to version 3.14.0 are vulnerable. This includes both client and server components that accept per‑request cookie parameters.

The CVSS base score of 6.6 indicates a medium severity of confidentiality compromise. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low observed exploitation. However, if an application relies on per‑request cookies and processes redirects, an attacker who can instruct the client to redirect to a malicious domain could steal cookies. The simplest attack vector involves instructing the AIOHTTP client to perform a redirect to an attacker‑controlled host; no local code execution is required.