cyfenced.com →

[ CVE-2026-107399 · Published 8 Oct 2026 ]

Mechanize sends credential headers to another origin after a meta refresh

CVSS 6.8 EPSS <1%Fix available

[ Description ]Official description

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

[ Fixes ]Fixes and patches

  • mechanize 2.14.1Fixed version · GitHub Advisories · rubygems package mechanize: upgrade to 2.14.1 or later (affected < 2.14.1)

[ Packages ]Affected open-source packages

[ References ]References