CVE-2026-91766: PHP Group PHP

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

Affected products

• PHP Group PHP: from 8.2, before 8.2.34 (fixed in 8.2.34); from 8.3, before 8.3.35 (fixed in 8.3.35); from 8.4, before 8.4.26 (fixed in 8.4.26); from 8.5, before 8.5.11 (fixed in 8.5.11)

Published 2026-09-25. Last modified 2026-09-29.