Files
FFmpeg/libavformat
Abdessamie 63cfa99169 avformat/rtsp: clear authentication on cross-origin redirects
RTSP redirects retain URL credentials and authentication state when a
Location URI changes to another origin. This can forward reusable
credentials to a server with a different scheme, host, or port.

Clear the stored credentials and authentication state when the redirect
crosses an origin boundary. Preserve them for same-origin redirects.

Fixes: cross-origin credential disclosure
Fixes: rtsp_redirect_auth_leak_poc.py
Fixes: VaKaPOnfN02z
(cherry picked from commit a441a2eb38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-08-02 02:47:32 +02:00
..
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-05-29 01:49:20 +00:00
2026-06-16 09:18:24 -03:00
2026-06-23 19:15:57 +02:00
2026-05-23 10:16:38 -05:00
2026-05-23 10:16:38 -05:00
2026-05-22 08:20:13 -05:00
2026-06-23 19:13:06 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-26 02:43:34 +02:00