new file mode 100644
@@ -0,0 +1,64 @@
+From 54aaf333cfe59f62d01ed06c8951da268ab2fb18 Mon Sep 17 00:00:00 2001
+From: Sam Bull <git@sambull.org>
+Date: Tue, 19 May 2026 01:23:00 +0100
+Subject: [PATCH] Drop cookies on redirect (#12550) (#12640)
+
+CVE: CVE-2026-47265
+Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478]
+
+(cherry picked from commit d57efb05f5073071ceb2d3b35d72d9d0bc4512a2)
+(cherry picked from commit f54c40851b0d6c4bbdab97ba518a223adda32478)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ CHANGES/12540.bugfix.rst | 1 +
+ aiohttp/client.py | 1 +
+ tests/test_client_functional.py | 16 ++++++++++++++--
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+ create mode 100644 CHANGES/12540.bugfix.rst
+
+diff --git a/CHANGES/12540.bugfix.rst b/CHANGES/12540.bugfix.rst
+new file mode 100644
+index 000000000..dfd98129e
+--- /dev/null
++++ b/CHANGES/12540.bugfix.rst
+@@ -0,0 +1 @@
++Fixed per-request ``cookies`` not being dropped on cross-origin redirects -- by :user:`Dreamsorcerer`.
+diff --git a/aiohttp/client.py b/aiohttp/client.py
+index 5d10d3e43..0637eff6b 100644
+--- a/aiohttp/client.py
++++ b/aiohttp/client.py
+@@ -892,6 +892,7 @@ class ClientSession:
+
+ if url.origin() != redirect_origin:
+ auth = None
++ cookies = None
+ headers.pop(hdrs.AUTHORIZATION, None)
+ headers.pop(hdrs.COOKIE, None)
+ headers.pop(hdrs.PROXY_AUTHORIZATION, None)
+diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py
+index 118ce19ca..ea31567c4 100644
+--- a/tests/test_client_functional.py
++++ b/tests/test_client_functional.py
+@@ -3564,8 +3564,20 @@ async def test_auth_persist_on_redirect_to_other_host_with_global_auth(
+ async with aiohttp.ClientSession(
+ connector=connector, auth=aiohttp.BasicAuth("user", "pass")
+ ) as client:
+- resp = await client.get(url_from)
+- assert resp.status == 200
++ async with client.get(
++ url_from,
++ headers={
++ "Proxy-Authorization": "Basic dXNlcjpwYXNz",
++ "Cookie": "a=b",
++ },
++ ) as resp:
++ assert resp.status == 200
++ async with client.get(
++ url_from,
++ headers={"Proxy-Authorization": "Basic dXNlcjpwYXNz"},
++ cookies={"a": "b"},
++ ) as resp:
++ assert resp.status == 200
+
+
+ async def test_drop_auth_on_redirect_to_other_host_with_global_auth_and_base_url(
@@ -8,6 +8,7 @@ SRC_URI[sha256sum] = "9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209
SRC_URI += " \
file://CVE-2026-34993.patch \
+ file://CVE-2026-47265.patch \
"
CVE_PRODUCT = "aiohttp"