cpp-httplib is a header‑only C++ HTTP/HTTPS library whose cross‑origin redirect handling mistakenly preserves Cookie headers, whereas other sensitive headers are removed. This leaves authenticated session cookies exposed to the redirect target. The weakness is a basic information‑exposure flaw (CWE‑522) that can enable an attacker to obtain a victim’s session credentials and potentially impersonate them, compromising confidentiality and integrity of user accounts.

The vulnerability affects any project that incorporates yhirose:cpp‑httplib version 0.50.x or earlier. Both the 301, 302, 307, and 308 redirect codes are impacted; 303 redirects are unaffected. This issue is fixed in 0.51.0; versions prior to that, especially those used in open‑source projects or embedded systems, remain vulnerable.

The CVSS score of 7.5 indicates a high severity. The EPSS score indicates a very low likelihood of exploitation (< 1%), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a controlled redirect response or a network position where an attacker can intercept HTTP traffic; a malicious redirect source can cause the client to send the victim’s cookies to an attacker‑controlled domain.