CVE-2026-12547
LowCVSS 3.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Vulnerability in SoupAuthManager that caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leading to credential leakage.
Risk Assessment
The risk involves leakage of proxy authentication credentials to an unauthorized proxy server, potentially enabling session hijacking or further attacks.
Recommendation
Update the SoupAuthManager library to a version where credentials are properly scoped to the specific proxy authority (host:port).
Original NVD description (English source)
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.