Every CVE Search/ Get API key

CVE-2026-107714

Mechanize sends credential headers to a different scheme or port after a redirect

5.9 MediumFix available

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.23%Unchanged since Oct 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Record
CVE-2026-107714
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-319, CWE-522
Updated
2026-11-02
EUVDEUVD-2026-95320 5.9

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Record
EUVD-2026-95320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
NVD 5.9

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Record
CVE-2026-107714
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-319, CWE-522
Updated
2026-11-02
OSV 5.9

Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Record
CVE-2026-107714
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-319, CWE-522
Updated
2026-11-02
OSVDEBIAN-CVE-2026-107714 5.9

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Record
DEBIAN-CVE-2026-107714
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-107714 5.9

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Record
UBUNTU-CVE-2026-107714
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ruby-mechanize
Debian:12
 All versions, plus listed versions
2.10.1-12.10.1-1.12.14.0-12.14.0-22.14.1-12.8.5-1
 None known
ruby-mechanize
Debian:13
 All versions, plus listed versions
2.10.1-12.10.1-1.12.14.0-12.14.0-22.14.1-1
 None known
ruby-mechanize
Debian:14
 before 2.14.1-1, plus listed versions
2.10.1-12.10.1-1.12.14.0-12.14.0-2
2.14.1-1
ruby-mechanize
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7.3-1
 None known
ruby-mechanize
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.7.5-12.7.5-2
 None known
ruby-mechanize
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.7.6-1
 None known
ruby-mechanize
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.7.7-12.7.7-3
 None known
ruby-mechanize
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.8.5-1
 None known
ruby-mechanize
Ubuntu:26.10
 All versions, plus listed versions
2.10.1-1.12.14.0-2
 None known
ruby-mechanize
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.10.1-1.1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-107714 is a medium vulnerability (CVSS 5.9) in Python-mechanize Mechanize, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in ruby-mechanize 2.14.1-1.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open