This vulnerability in the Dio HTTP client allows a server to force an application to follow a cross‑origin redirect while preserving sensitive request headers. The redirect occurs without checking whether the destination origin matches the source, so Authorization, Cookie, and Proxy‑Authorization headers can be sent to an untrusted domain, exposing authentication credentials and potentially enabling credential theft or session hijacking.

The flaw affects the Dio package, released by cfug, for Dart/Flutter developers. Versions from 1.0.0 up to, but not including, 2.8.0 are susceptible when the Http2Adapter component is used and the default redirect‑following behavior is enabled.

The issue has a CVSS score of 7.5, indicating a high severity. The EPSS score is unavailable, so the exact likelihood of exploitation remains unclear, and the vulnerability is not listed in CISA's KEV catalog. An attacker who can control a server that the client contacts could issue a Location header pointing to a malicious domain; because the client blindly copies all headers, credentials may be exposed to that domain. This scenario requires network access to the application or the ability to inject a redirect response, making it a medium‑to‑high risk for applications that rely on authenticated Http2Adapter requests.