LOW 3.1 GitHub
CVE-2026-59180
Apprise forwards configured auth headers across cross-origin HTTP redirects
# Summary
Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders (`apprise/attachment/http.py`, `apprise/config/http.py`) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, that destination can return a `302 Location:` to
Affected Products
- pip/apprise <= 1.10.0
References
- https://github.com/advisories/GHSA-856c-92hv-3vxx
- https://github.com/caronc/apprise/security/advisories/GHSA-856c-92hv-3vxx
- https://nvd.nist.gov/vuln/detail/CVE-2026-59180
- https://github.com/caronc/apprise/pull/1610
This low severity vulnerability with a CVSS score of 3.1 was published on 2026-10-14 via GitHub. Affected: pip/apprise <= 1.10.0.
vulnfeed aggregates 15189 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.