Detections
Analytics
CVE-2026-49853
high
Description
The vulnerability exists due to a shallow-copy flaw inside the redirection handling of the SimpleAsyncHTTPClient component in Tornado. When following an HTTP 3xx redirect, the client clones the original request context and strips only the Host header, failing to clear authentication headers (Authorization, Cookie) or explicit credentials (auth_username, auth_password) if the destination target redirects cross-origin to an entirely different host, scheme, or port.