CyberRota Analysis
AI-GeneratedThe Apprise library, prior to version 1.11.0, is vulnerable due to its default behavior of following HTTP redirects, which can inadvertently expose sensitive user-configured authentication details to compromised destinations or on-path attackers. This could lead to unauthorized access to services that rely on these credentials. Organizations using Apprise for notifications should prioritize upgrading to version 1.11.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.