CVE-2026-103030

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

Summary

dio_http2_adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorization headers verbatim. This vulnerability has a CVSS v3.1 base score of 7.5 (High) because followRedirects is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.

Details

When Dio is configured to use Http2Adapter, the adapter's internal _fetch method constructs HTTP/2 request headers by unconditionally copying all entries from options.headers:

// plugins/http2_adapter/lib/src/http2_adapter.dart:111
headers.addAll(
  options.headers.entries.map((entry) {
    ...
    return Header.ascii(entry.key.toLowerCase(), v);
  }).toList(),
);

On receiving a 3xx response, the adapter reads the Location header and resolves the redirect target URI:

// plugins/http2_adapter/lib/src/http2_adapter.dart:254-263
final url = responseHeaders.value('location');
final uri = Uri.parse(url ?? '');
final String path = resolveRedirectUri(options.uri, uri).toString();
return _fetch(options.copyWith(path: path, maxRedirects: --options.maxRedirects), ...);

options.copyWith is called without an explicit headers argument; dio/lib/src/options.dart:629 therefore preserves the full original header map via headers ?? Map.from(this.headers). resolveRedirectUri (http2_adapter.dart:290) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including Authorization, Cookie, and Proxy-Authorization — is forwarded to the new authority with no sanitization.

Data flow (source → sink):

1. dio/lib/src/dio_mixin.dart:383 — public Dio.request<T>(String path, ...) entry point.
2. dio/lib/src/options.dart:331 — base and per-request headers merged into RequestOptions.
3. dio/lib/src/dio_mixin.dart:596 — httpClientAdapter.fetch(reqOpt, ...) dispatches to Http2Adapter.
4. plugins/http2_adapter/lib/src/http2_adapter.dart:254 — Location header is read from the network response (attacker-controlled source).
5. plugins/http2_adapter/lib/src/http2_adapter.dart:258 — redirect target URI resolved; cross-origin check absent.
6. plugins/http2_adapter/lib/src/http2_adapter.dart:260 — options.copyWith(path: path, ...) called without headers override.
7. dio/lib/src/options.dart:629 — copyWith preserves Map.from(this.headers) — all sensitive headers retained.
8. plugins/http2_adapter/lib/src/http2_adapter.dart:111 — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink).

Suggested patch — strip sensitive headers before following a cross-origin redirect:

--- a/plugins/http2_adapter/lib/src/http2_adapter.dart
+++ b/plugins/http2_adapter/lib/src/http2_adapter.dart
+  static const _sensitiveRedirectHeaders = {
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+  };
+
-      final String path = resolveRedirectUri(options.uri, uri).toString();
+      final redirectUri = resolveRedirectUri(options.uri, uri);
+      final redirectOptions = options.copyWith(
+        path: redirectUri.toString(),
+        maxRedirects: --options.maxRedirects,
+      );
+      if (!_sameOrigin(options.uri, redirectUri)) {
+        redirectOptions.headers.removeWhere(
+          (name, _) => _sensitiveRedirectHeaders.contains(name.toLowerCase()),
+        );
+      }
       return _fetch(
-        options.copyWith(path: path, maxRedirects: --options.maxRedirects),
+        redirectOptions,
         list != null ? Stream.fromIterable(list) : null,
         cancelFuture,
         redirects,
       );
+
+  static bool _sameOrigin(Uri a, Uri b) =>
+      a.scheme ==…

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

Summary

dio_http2_adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorization headers verbatim. This vulnerability has a CVSS v3.1 base score of 7.5 (High) because followRedirects is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.

Details

When Dio is configured to use Http2Adapter, the adapter's internal _fetch method constructs HTTP/2 request headers by unconditionally copying all entries from options.headers:

// plugins/http2_adapter/lib/src/http2_adapter.dart:111
headers.addAll(
  options.headers.entries.map((entry) {
    ...
    return Header.ascii(entry.key.toLowerCase(), v);
  }).toList(),
);

On receiving a 3xx response, the adapter reads the Location header and resolves the redirect target URI:

// plugins/http2_adapter/lib/src/http2_adapter.dart:254-263
final url = responseHeaders.value('location');
final uri = Uri.parse(url ?? '');
final String path = resolveRedirectUri(options.uri, uri).toString();
return _fetch(options.copyWith(path: path, maxRedirects: --options.maxRedirects), ...);

options.copyWith is called without an explicit headers argument; dio/lib/src/options.dart:629 therefore preserves the full original header map via headers ?? Map.from(this.headers). resolveRedirectUri (http2_adapter.dart:290) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including Authorization, Cookie, and Proxy-Authorization — is forwarded to the new authority with no sanitization.

Data flow (source → sink):

1. dio/lib/src/dio_mixin.dart:383 — public Dio.request<T>(String path, ...) entry point.
2. dio/lib/src/options.dart:331 — base and per-request headers merged into RequestOptions.
3. dio/lib/src/dio_mixin.dart:596 — httpClientAdapter.fetch(reqOpt, ...) dispatches to Http2Adapter.
4. plugins/http2_adapter/lib/src/http2_adapter.dart:254 — Location header is read from the network response (attacker-controlled source).
5. plugins/http2_adapter/lib/src/http2_adapter.dart:258 — redirect target URI resolved; cross-origin check absent.
6. plugins/http2_adapter/lib/src/http2_adapter.dart:260 — options.copyWith(path: path, ...) called without headers override.
7. dio/lib/src/options.dart:629 — copyWith preserves Map.from(this.headers) — all sensitive headers retained.
8. plugins/http2_adapter/lib/src/http2_adapter.dart:111 — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink).

Suggested patch — strip sensitive headers before following a cross-origin redirect:

--- a/plugins/http2_adapter/lib/src/http2_adapter.dart
+++ b/plugins/http2_adapter/lib/src/http2_adapter.dart
+  static const _sensitiveRedirectHeaders = {
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+  };
+
-      final String path = resolveRedirectUri(options.uri, uri).toString();
+      final redirectUri = resolveRedirectUri(options.uri, uri);
+      final redirectOptions = options.copyWith(
+        path: redirectUri.toString(),
+        maxRedirects: --options.maxRedirects,
+      );
+      if (!_sameOrigin(options.uri, redirectUri)) {
+        redirectOptions.headers.removeWhere(
+          (name, _) => _sensitiveRedirectHeaders.contains(name.toLowerCase()),
+        );
+      }
       return _fetch(
-        options.copyWith(path: path, maxRedirects: --options.maxRedirects),
+        redirectOptions,
         list != null ? Stream.fromIterable(list) : null,
         cancelFuture,
         redirects,
       );
+
+  static bool _sameOrigin(Uri a, Uri b) =>
+      a.scheme ==…