Mechanize, a web‑automation library, sends attacker‑supplied credential headers such bearer tokens and session cookies to a redirection target host. Before v2.14.1 the library does not strip these headers after an HTTP redirect, allowing a malicious redirection to capture sensitive credentials. The compromise is the unintentional disclosure of authentication information that can be used to impersonate a user or access protected resources.

The vulnerability affects the Mechanize library from Sparklemotion, versions prior to 2.14.1. Applications that depend on these older versions and pass credentials via request_headers or the per-request headers argument are susceptible.

The CVSS score of 6.8 indicates moderate severity. Because the flaw is triggered by an attacker controlling a redirect target and does not require additional privileges, the likelihood of exploitation in the wild is considered realistic. The issue is not listed in the CISA KEV catalog and no EPSS score is available, but the attack vector is remote, making it accessible over the network to anyone who can host a malicious redirect. Once the redirect is triggered, credentials used in the original request can be captured, leading to potential account takeover or data exfiltration.