Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInformation disclosure in the Networking: HTTP component
ComponentNetworking
Bug ClassLogic Error
Tracker2051466
Fix commit32e317d019d4 (firefox) +7/-0
CISA KEVNot listed
CreditedGee-netics
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
if
netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
modified

Files Changed

  • netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
diff --git a/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp b/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
index aa6e9402bb4..cacd523a510 100644
--- a/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
+++ b/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
@@ -879,6 +879,13 @@ nsresult nsHttpChannelAuthProvider::GetCredentialsForChallenge(
   // as restartable.
   mAuthChannel->ConnectionRestartable(!authAtProgress);
 
+  if (identFromURI &&
+      (authFlags & nsIHttpAuthenticator::IDENTITY_INCLUDES_DOMAIN)) {
+    LOG(("  ignoring URL identity for a domain-identity scheme\n"));
+    ident->Clear();
+    identFromURI = false;
+  }
+
   if (identityInvalid) {
     if (entry) {
       if (ident->Equals(entry->Identity())) {
Loading diff…