CVE-2026-59180
Apprise forwards configured auth headers across cross-origin HTTP redirects
Published Oct 14, 2026 · updated Oct 14, 2026
# Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders ( , ) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, that destination can return a to an arbitrary host and Apprise forwards the user's secret ( , , bearer tokens in query, custom values) to that cross-origin host. The attacker does **not** need to control the original Apprise URL — only the response from a destination the operator already trusts. This is the application-layer analogue of urllib3 [ ](https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf) / (" forwarded across cross-origin redirect"). # Affected versions All releases up to and including (latest PyPI release as of filing, 2026-04-26). Fixed in v1.11.0 (released 2026-05-29), which includes [PR #1610](https://github.com/caronc/apprise/pull/1610) (merged 2026-05-16, commit 68c0aef218055e4586cf4605fd6b56358f5f462d). # Details (pre-fix HEAD, lines 226-244, verbatim): follows 3xx redirects by default and re-attaches the dict on the redirected request, regardless of origin. The same shape exists across ~50 plugins ( , , , , , , , and most other HTTP-based plugins), plus in and . ## Reproduction (local, safe) Observed on HEAD (2026-05-13): prints -- the user-supplied token followed the cross-origin redirect. # Patch Fix landed in [ ](https://github.com/caronc/apprise/pull/1610) (merged 2026-05-16, commit ): - Adds URL parameter on every plugin URL - Adds global default - Equivalent flags wired into and The default remains for backwards compatibility -- operators who relay notifications through destinations they don't fully trust should append to their Apprise URLs or set globally. Released in v1.11.0 (2026-05-29, available on PyPI). Related: - Docum
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · GitHub Advisory Database
Detected
# Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders ( , ) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, t
Oct 14, 2026 · GitHub Advisory Database
Fix available
apprise fixed in 1.11.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
apprise fixed in 1.11.0
Oct 14, 2026 · GitHub Advisory Database
Updated
# Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders ( , ) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, t
Affected
- PyPI apprise0 → 1.11.0
- pypi appriseversion unspecified
Sources
- CVE.orgCVE-2026-59180
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-59180
30-day exploitation probability 0.3%
first.org - GitHub Advisory DatabaseGHSA-856c-92hv-3vxx
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabaseCVE-2026-59180
Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders (apprise/attachment/http.py, apprise/config/http.py) follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position
advisories.gitlab.com - OSV.devGHSA-856c-92hv-3vxx
Apprise forwards configured auth headers across cross-origin HTTP redirects
osv.dev