dio_http2_adapter CVE-2026-103030 leaks auth headers on cross-origin redirects
A high-severity flaw in dio_http2_adapter forwards sensitive credentials to third-party servers during redirects, exposing users to credential theft.
Key points
- Versions 1.0.0 through 2.7.1 of dio_http2_adapter are vulnerable to credential leakage.
- The flaw allows attackers to capture Authorization, Cookie, and Proxy-Authorization headers.
- Patch version 2.8.0 is available to resolve the high-severity security issue.
The dio_http2_adapter package contains a high-severity vulnerability that exposes sensitive user credentials during HTTP redirects. Developers using versions 1.0.0 through 2.7.1 must update to 2.8.0 to prevent unauthorized access to authentication tokens and cookies.
What happened
The dio_http2_adapter package, which handles HTTP/2 connections for the Dio client, fails to sanitize request headers when following redirects across different origins. According to GitHub advisory GHSA-cr65-55v9-xhvv, the adapter unconditionally copies all headers from the original request options when constructing new HTTP/2 requests. This behavior includes sensitive fields such as Authorization, Cookie, and Proxy-Authorization.
When the adapter receives a 3xx response, it reads the Location header and resolves the redirect target URI. The code then calls options.copyWith without explicitly removing headers, preserving the full original header map via default logic. The resolveRedirectUri function returns the attacker-controlled cross-origin URI without performing any origin comparison checks.
An attacker who can influence an origin server to return a 302 redirect to a different domain receives the victim's sensitive headers verbatim. The vulnerability is classified as high severity with a CVSS v3.1 base score of 7.5. This rating reflects that followRedirects is enabled by default, no authentication is required to exploit the flaw, and the confidentiality impact is high.
Why it matters
This flaw compromises the confidentiality of user sessions and authentication tokens in applications using the affected versions of dio_http2_adapter. Because the adapter forwards headers to any redirect target, attackers can harvest credentials by serving malicious redirect responses from compromised or controlled servers.
The default configuration of the Dio client exacerbates the risk, as redirect following is enabled out of the box. Users do not need to take additional steps to trigger the vulnerability; standard HTTP interactions with malicious servers are sufficient for exploitation. The lack of origin validation means that sensitive data can leak to entirely unrelated domains.
What to watch
- Monitor server logs for unexpected 302 redirects to external domains.
- Check if your application uses dio_http2_adapter versions between 1.0.0 and 2.7.1.
- Verify that sensitive headers are not being sent to third-party endpoints.
- Review network traffic for unauthorized transmission of Authorization headers.
Signals worth monitoring
Teams usually detect this type of activity by observing unusual redirect patterns in application logs. Security operations centers should check whether sensitive headers are being transmitted to unexpected external domains. Analysts often see spikes in cross-origin requests following authentication events. Monitoring systems should alert when Authorization or Cookie headers appear in requests to third-party servers. Incident responders typically isolate affected endpoints to prevent further credential leakage.
What to do and how to stay safe: dio_http2_adapter
- Update dio_http2_adapter to version 2.8.0 or later to apply the security fix.
- Audit your application's network requests to ensure sensitive headers are not leaked.
- Implement strict redirect validation to prevent cross-origin credential exposure.
- Monitor server logs for unusual redirect patterns that may indicate exploitation.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of dio_http2_adapter are vulnerable to CVE-2026-103030?
Versions 1.0.0 through 2.7.1 are vulnerable to this high-severity credential leakage flaw.
What is the CVSS score for this vulnerability?
The vulnerability has a CVSS v3.1 base score of 7.5, which is classified as high severity.
How can developers fix this issue?
Developers should upgrade to dio_http2_adapter version 2.8.0, which includes the necessary patch.
