Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiohttp | pip | <= 3.14.0 | 3.14.1 |
Miggo AIRoot Cause AnalysisThe vulnerability described in GHSA-hpj7-wq8m-9hgp for aiohttp is that the DigestAuthMiddleware can send authentication credentials to a cross-origin server after a redirect. The provided patch 38d16060037e1bfcd6d677abababa3c2a4bb58fa modifies the __call__ method in aiohttp/client_middleware_digest_auth.py. The changes introduce origin checking. Specifically, the middleware now stores the origin of the first request and, on subsequent requests, verifies that the request's origin matches the initial origin or is within an explicitly defined protection space. If the origin does not match, the request is passed through without adding authentication headers. This directly addresses the reported vulnerability. Therefore, the DigestAuthMiddleware.__call__ function is the vulnerable function, as it was responsible for handling the authentication logic for redirected requests without proper origin validation.
DigestAuthMiddleware.__call__aiohttp/client_middleware_digest_auth.py