The vulnerability occurs when DigestAuthMiddleware sends authentication credentials after following a cross‑origin redirect. An attacker who can influence the redirect path—such as through an open‑redirect flaw on the target domain—can cause a client to transmit digest responses to a controlled server. If the digest is weak or credentials are reused, this may allow credential compromise. The weakness is an information disclosure of authentication secrets, mapping to CWE‑200 and CWE‑522.

The issue affects the aio‑libs aiohttp asynchronous HTTP framework for Python. Any installation of aiohttp prior to version 3.14.1 that uses DigestAuthMiddleware and allows redirects to external origins is susceptible. The fix is released in 3.14.1.

With a CVSS score of 6.3 the vulnerability has moderate severity. Exploitability is limited by the need for an accessible redirect on the target domain. Attackers would need to deliver a crafted request that triggers a cross‑origin redirect that the library follows, causing the client's digest response to be sent to the attacker’s server. No published exploits are known, and the issue is not in CISA KEV. The EPSS is not reported; thus, the likelihood of public exploitation remains unclear, but the presence of an open‑redirect or similar makes it a realistic threat in vulnerable applications.