Security Advisory 2026-0080

Details

The souphttpsrc element in gst-plugins-good follows HTTP redirects automatically by default. When a redirect crosses origin boundaries (different scheme, host, or port), the redirected request carried sensitive state from the original request without restriction. Specifically, manually configured cookies, custom headers from the extra-headers property, and Basic authentication credentials from user-id/user-pw were all forwarded to the redirect target regardless of origin. A similar issue affected proxy authentication credentials configured via proxy-id/proxy-pw.

This is equivalent to CVE-2018-1000007 in curl and CVE-2021-31879 in wget. The fix introduces a location-trusted property (default false) that strips cookies, extra headers, and authentication credentials on cross-origin redirects.

Impact

An attacker who controls the initial HTTP location and can cause an application to open it with souphttpsrc configured with credentials, cookies, or custom headers can redirect the request to an attacker-controlled endpoint and collect the forwarded credentials. This enables theft of media access tokens, API keys, session cookies, and Basic Auth credentials.

Solution

The gst-plugins-good 1.28.7 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.7 release

• Release Notes
• GStreamer Plugins Good 1.28.7

Patches

• Patch