highPublished October 15, 2026

dio HTTP/2 adapter (Dart/Flutter): your login token is sent to other sites on redirects

Identifiers: CVE-2026-103030 · GHSA-cr65-55v9-xhvv · CVSS 3.1 7.5 (scored by GitHub)

What it is

When Dio uses Http2Adapter it follows redirects by default and copies every request header to the new address, even when it is another site. If any server your app calls answers with a redirect to an attacker's site, the attacker receives the user's Authorization, Cookie and Proxy-Authorization headers and can act as that user.

Who is affected

Versions inside these ranges are affected. The fixed versions are the ones to move to.

Registry	Package	Affected	Move to
Pub	dio_http2_adapter	>= 1.0.0, <= 2.7.1	2.8.0

How to check

Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:

Linux (x86_64 or arm64), WSL and CI runners

d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps

macOS or Windows, with Docker

docker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'

Already have the CLI?

xsec deps

Or look up dio_http2_adapter in your lockfile and compare the version with the ranges above.

How to fix it

Upgrade dio_http2_adapter to 2.8.0 or later (flutter pub upgrade dio_http2_adapter) and ship a new app build. Until then set followRedirects: false on requests that carry credentials. If you suspect a token leaked, revoke it.

Sources

This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.