Technical impact
Based on the description, it is inferred that the vulnerability occurs when DigestAuthMiddleware sends authentication credentials after following a cross-origin redirect. An attacker who can influence the redirect path—such as through an open‑redirect flaw on the target domain—can cause a client to transmit digest responses to a controlled server. If the digest is weak or credentials are reused, this may allow credential compromise. The weakness is an information disclosure of authentication secrets, mapping to CWE-200, CWE-522, CWE-601, and CWE-940.
Affected Systems
The issue affects the aio-libs aiohttp asynchronous HTTP framework for Python. Any installation of aiohttp prior to version 3.14.1 that uses DigestAuthMiddleware and allows redirects to external origins is susceptible. The fix is released in 3.14.1.
Risk and Exploitability
With a CVSS score of 6.3 the vulnerability has moderate severity. Based on the description, it is inferred that exploitability requires an accessible redirect on the target domain. Attackers would need to deliver a crafted request that triggers a cross-origin redirect that the library follows, causing the client's digest response to be sent to the attacker’s server. No published exploits are known, and the issue is not in CISA KEV. The EPSS score is < 1%; thus, the likelihood of public exploitation remains unclear, but the presence of an open-redirect or similar makes it a realistic threat in vulnerable applications.
Github GHSA