Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders (apprise/attachment/http.py, apprise/config/http.py) follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, that destination can return a 302 Location: to an arbitrary host and Apprise forwards the user's secret (X-Gotify-Key, Authorization, bearer tokens in query, custom +Header= values) to that cross-origin host. The attacker does not need to control the original Apprise URL — only the response from a destination the operator already trusts. This is the application-layer analogue of urllib3 GHSA-34jh-p97f-mpxf / CVE-2026-44431 ("Proxy-Authorization forwarded across cross-origin redirect"). Affected versions All releases up to and including v1.10.0 (latest…
Recommended action: Upgrade to 1.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Anyone publicly hosting the Apprise library and granting them access to the IFTTT notification service. Patches Update to Apprise v0.9.5.1 The patch to the problem was performed here. Workarounds Alternatively, if upgrading is not an option, you can safely remove the following file: - apprise/plugins/NotifyIFTTT.py The above will eliminate the ability to use IFTTT, but everything else will work smoothly. For more information If you have any questions or comments about this advisory: Open an issue in Apprise Email me at lead2gold@gmail.com Additional Credit Github would not allow me to additionally credit Rasmus Petersen, but I would like to put that here at the very least - thank you for finding and reporting this issue along with those already credited Additional Notes: - Github would not allow me to add/tag the 2 CWE's this issue is applicable to (only CWE-400). The other is: CWE-730 (placed in the title)
Recommended action: Upgrade to 0.9.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.