CVE-2026-121554
Medium · 5.9CVSS
5.9
EPSS
0.5%
Published
Nov 3, 2026
CISA due date
—
The record
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120716 Insertion of sensitive information into sent data in the identity provider user… CWE-201
- CVE-2026-115293 Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability… CWE-201
- CVE-2026-114183 Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere… CWE-201
- CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher… CWE-201
- CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
- CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
- CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
- CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor… CWE-201