The flaw allows an OAuth2 bearer token originally intended for an HTTPS transfer to be inadvertently forwarded to a downstream host when the transfer follows a cross‑protocol redirect to protocols such as IMAP, LDAP, POP3 or SMTP. This results in token leakage that could grant an attacker unauthorized access to resources protected by the token. The weakness is a type of redirect to an unexpected protocol (CWE‑601) and results in a moderate security impact.

The vulnerability is present in the curl client library produced by Haxx. No specific affected versions are listed in the CNA data, so administrators should review the latest release notes for any applied fix and test their current installations for the presence of the bug.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% indicates that the likelihood of exploitation is low at present. Because the attack requires a curl client to perform a redirect to a non‑HTTP schema, the exposure is limited to environments that use curl in such a way that a redirect might target IMAP/LDAP/etc. The vulnerability is not listed in CISA’s KEV catalog, so no large‑scale exploitation is currently documented. Nevertheless, any pipeline that issues curl requests with bearer tokens should be assessed for the presence of cross‑protocol redirects to ensure the token is not leaked.