CVE-2026-49853 PUBLISHED

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Assigner: GitHub_M
Reserved: 01.06.2026 Published: 14.07.2026 Updated: 14.07.2026

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	tornadoweb
Product	tornado
Versions	Version < 6.5.6 is affected

References

https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
https://github.com/tornadoweb/tornado/pull/3626
https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751
https://github.com/tornadoweb/tornado/releases/tag/v6.5.6

Problem Types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE