Mechanize library leaks credentials on HTTP redirects

The mechanize Ruby library leaked HTTP credentials to redirect targets on different hosts when credentials were set via request_headers or per-request headers, exposing bearer tokens and session cookies.

Disclosed 8 October 2026 · Record updated 9 October 2026

Impact

Credentials leaked to attacker-controlled redirect targets through HTTP redirects to different hosts, limited to headers set manually rather than from credential stores

Our coverage

A delivery robot follows a redirected arrow sign, accidentally handing its authentication badge to a stranger in a different warehouse zone.

Vulnerabilities

Mechanize leaked auth headers to redirect targets

A flaw in the Ruby HTTP library sent bearer tokens and cookies to other hosts after a redirect, fixed in version 2.14.1.

9 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-2mwr-xjcg-37j7