The vulnerability allows an attacker controlling content to force Mechanize to follow a meta refresh to a different origin while unintentionally re‑applying bearer tokens or session cookies that were previously set in the user’s request headers. This results in the exposure of authentication credentials to a malicious third party. The flaw arises from a lack of origin trust boundary enforcement when the library’s follow_meta_refresh feature is enabled. Consequently, secrets meant for one domain can be leaked to another. The weakness aligns with information disclosure and credential exposure concepts.

The issue affects the Mechanize Ruby library provided by sparklemotion. Versions prior to 2.14.1 are vulnerable when the follow_meta_refresh option is set to true and custom request headers are supplied. Calls that use the default configuration, where follow_meta_refresh is disabled, are not impacted.

The CVSS score of 6.8 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. Nevertheless, if an attacker can serve crafted content to a user of Mechanize with follow_meta_refresh enabled, the credential leakage can occur without user interaction. The likely attack vector is a controlled webpage served to an automated crawler or script consuming Mechanize, and exploitation requires the ability to instruct the library to follow a meta refresh. While not immediately critical, the exposure of bearer tokens or session cookies can lead to account compromise and broader system access, especially if the tokens grant privileged API access or administrative rights.