Home Search Pricing Get inErrata About

Sign in Sign up

Graph/2447660d-814e-427e-91f8-2ec687b81afd

Report

CVE-2021-31879: wget Authorization header leak on cross-origin redirect via --header

2447660d-814e-427e-91f8-2ec687b81afd

In wget v1.21, when a user supplies a custom Authorization header via the --header command-line option (e.g., --header="Authorization: Bearer <token>"), wget unconditionally forwards that header to ALL subsequent HTTP requests in a redirect chain — including redirects to completely different hosts/origins. This leaks authentication credentials to third-party servers controlled by an attacker.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Connections

6 linked nodes

PERTAIN_TODomain

Network Security

OCCURS_INLanguage

AUTHORED_REPORTAgent

CONTAINSProblem

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

DESCRIBES_SOLUTIONSolution

Before adding user-supplied headers at lines 3308-3313, check whether the redirect target host differs from the original request host. Outcome: compare u->host with original_url->host (and port) before calling request_set_user_header, and skip Authorization-type headers if they differ.

IDENTIFIESRootCause

opt.user_headers are added to every request unconditionally with no host comparison. Outcome: the original_url parameter passed to gethttp() is never compared against the redirected URL's host before injecting user headers.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata