PHP CVE-2026-91766 Exposes Legacy Redirect Credential Leak Fixed in Curl 2018
CVE-2026-91766 is a credential‑leak vulnerability in PHP’s handling of HTTP redirects that can expose authentication tokens when the underlying curl library does not enforce safe redirect policies; the root cause was patched in curl back in 2018, yet many legacy PHP deployments still run vulnerable versions, putting user credentials at risk (r/netsec discussion).
What exactly does CVE-2026-91766 expose?
The flaw occurs when PHP code delegates HTTP requests to curl and follows a 3xx redirect that contains embedded credentials in the URL (e.g., https://user:pass@example.com). If curl does not strip these credentials before following the redirect, they are sent to the next host, potentially leaking them to an attacker who controls the redirect target. This leakage can include session cookies, API keys, or basic‑auth passwords.
How did the original curl bug contribute to the leak?
In 2018 curl introduced a safety check that removes user‑info from redirected URLs unless explicitly allowed. The patch was designed to prevent exactly the scenario described above. However, PHP’s wrapper around curl historically passed the raw URL to curl without enabling the new safety flag, meaning older PHP‑curl bindings continued to inherit the insecure behavior even after the curl fix was released (r/netsec discussion).
Which environments are most likely still vulnerable?
Any PHP application that:
- Uses the
curl_execfamily of functions for outbound HTTP calls, and - Runs on a system with a curl version older than the 2018 patch, or a PHP‑curl extension compiled against such a library.
What practical steps can developers take to remediate?
First, verify the curl version on your server with curl --version. If it predates the 2018 release, upgrade to the latest stable package from your OS vendor or compile a recent version from source. Second, ensure the PHP‑curl extension is rebuilt against the updated library so the safety flag is active.
If an immediate upgrade is not feasible, mitigate by sanitizing URLs before passing them to curl: strip any user:pass@ component, or explicitly disable redirects with CURLOPT_FOLLOWLOCATION and handle redirects manually after validating the target. Logging outbound URLs and monitoring for unexpected credential patterns can also reveal exploitation attempts.
How does GetKhojo help you discover and protect against this issue?
GetKhojo’s scanning suite includes a dedicated module that probes for vulnerable PHP‑curl configurations. The scanner performs a controlled redirect test that injects dummy credentials and checks whether they appear in subsequent requests, flagging any instance of the leak. Results are presented with actionable remediation guidance, including exact package versions to upgrade.
Beyond detection, GetKhojo offers continuous privacy‑hygiene monitoring. By regularly re‑scanning your attack surface, you can catch regressions caused by new deployments or third‑party libraries that re‑introduce the old curl binary.
What this means for you
If your organization runs PHP applications that make outbound HTTP calls, you should treat CVE-2026-91766 as a high‑priority audit item. Verify curl versions, rebuild PHP‑curl extensions, and consider using GetKhojo’s automated scans to validate that credentials are no longer exposed during redirects. Proactive patching and regular surface‑level scanning will keep your users’ authentication data private and your web services resilient.
Frequently asked questions
How can I tell if my PHP application is vulnerable to CVE-2026-91766?
Run <code>curl --version</code> on the host and check the PHP‑curl extension’s linked library; if it’s older than the 2018 patch, or if your code follows redirects without sanitizing URLs, you are likely vulnerable.
Does upgrading PHP alone fix the redirect credential leak?
No. The fix resides in the curl library, not PHP itself. You must upgrade curl and ensure the PHP‑curl extension is rebuilt against the newer library for the protection to take effect.
Can GetKhojo detect this vulnerability in a large fleet of servers?
Yes. GetKhojo’s vulnerability scanner includes a test that injects credentials into a redirect chain and verifies whether they are leaked, allowing you to identify any server that still runs the insecure curl version.
What are the risks if the credential leak is exploited?
An attacker who controls a redirect target can capture exposed usernames, passwords, API keys, or session tokens, potentially gaining unauthorized access to downstream services or user accounts.
Is disabling redirects a safe long‑term solution?
Disabling redirects prevents the specific leak but can break legitimate functionality. It is better to upgrade curl and use proper URL sanitization; disabling should only be a temporary mitigation.
