Vulnerability Intelligence Report
Auth bypass in Dark SDK
CVE-2022-0451
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
No Active Exploit Signals
CVSS Base Score
6.5
MEDIUM
Exploitability:2.9
Impact Score:3.6
EPSS Probability:0.98%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-305 ↗CWE-305 Authentication Bypass by Primary Weakness
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Google LLC | Dart SDK | unspecified < 2.16.0 (affected) |
Threat Intelligence Signals
EPSS Score
0.982%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Google LLC · Vendor · USA |
| Reserved | 2022-02-01T00:00:00 |
| Published | 2022-02-18T13:35:11 |
| Patch Date | 2022-02-03 |
| Last Updated | 2025-04-21T13:56:39 |
Community Chatter & Buzz