Open Redirect in Microsoft Github.com/microsoft/kiota-Http-Go
CVE-2026-44503
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Vulnerability class: Open Redirect
Published · last modified .
EPSS exploit prediction
EPSS: 0.008 (56.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.003
Affected products
- Microsoft Github.com/microsoft/kiota-Http-Go — versions < 1.5.5
- Microsoft Kiota-Java — versions < 1.9.1
- Microsoft Kiota-Typescript — versions < 1.0.0-preview.100
- Microsoft Microsoft-Kiota-Abstractions — versions < 1.9.1
- Microsoft Microsoft.kiota.abstractions — versions < 1.22.0
- Microsoft Microsoft-Kiota-Http — versions < 1.9.9