CVE-2026-91766

medium

Assigned by CNA: php

Published 2026-09-25 · Modified 2026-09-25

Discuss on Community Propose mitigation

CVSS v3

5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.9

Description

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

Predictions

Exploit likelihood

69%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-91766 NameCVE-2026-91766 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus php8.2 (PTS)bookworm8.2.32-1~deb12u1vulnerable bookworm…

CVE-2026-91766

Name	CVE-2026-91766
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php8.2 (PTS)	bookworm	8.2.32-1~deb12u1	vulnerable
	bookworm (security)	8.2.33-1~deb12u1	vulnerable
php8.4 (PTS)	trixie (security), trixie	8.4.24-1~deb13u1	vulnerable
	forky, sid	8.4.24-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php8.2	source	(unstable)	(unfixed)
php8.4	source	(unstable)	(unfixed)

Notes

https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92
https://github.com/php/php-src/blob/php-8.4.26/NEWS

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92https://github.com/php/php-src/blob/php-8.4.26/NEWS

OS impact

Debian Affected 4 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Affected	—
forky	Affected	—
bookworm	Affected	—

Alpine Fixed 1 release

Version	Status	Fixed in
v3.24	Fixed	`8.3.35-r0`

References

CWEs

CWE-200 CWE-522

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.