`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-15806
StatePUBLISHED
AssignerPSF
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-18 16:17:02 UTC
Updated2026-09-02 01:17:23 UTC
DescriptionThe HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

Risk And Classification

Primary CVSS: v4.0 6 MEDIUM from [email protected]

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS: 0.004070000 probability, percentile 0.337920000 (date 2026-08-31)

Problem Types: CWE-319 | CWE-522 | CWE-319 CWE-319 | CWE-522 CWE-522

VersionSourceTypeScoreSeverityVector
4.0[email protected]Secondary6MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C...
4.0CNACVSS6MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS v4.0 Breakdown

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
Passive
Confidentiality
High
Integrity
None
Availability
None
Sub Conf.
None
Sub Integrity
None
Sub Availability
None

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Python Software Foundation CPython affected 3.15.0rc2 python Not specified

References

ReferenceSourceLinkTags
github.com/python/cpython/issues/155694 134c704f-9b21-4f2e-91b3-4a467353bcc0 github.com
github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6 [email protected] github.com
www.openwall.com/lists/oss-security/2026/08/18/3 af854a3a-2127-422b-91ae-364da2661108 www.openwall.com
github.com/python/cpython/pull/155696 [email protected] github.com
github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce [email protected] github.com
github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc [email protected] github.com
github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce [email protected] github.com
github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8 [email protected] github.com
mail.python.org/archives/list/[email protected]/thread/3OKPE5S75KD... [email protected] mail.python.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Łukasz (https://github.com/lkk7) (en)

CNA: Kirill Podoprigora (https://github.com/Eclips4) (en)

CNA: Senthil Kumaran (https://github.com/orsenthil) (en)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report