The bug in the Erlang/Elixir HTTP client hackney causes the client to forward Authorization and Cookie headers when following redirects that stay on the same host but switch to a different scheme or port. Because the redirect logic strips credentials only when the hostname changes, the credentials are resent over cleartext traffic or to another service listening on the same hostname. This results in the credentials being exposed to an attacker who can influence or provide the redirect, leading to credential leakage. The weakness is classified as CWE‑522, insufficiently protected credentials.

The issue affects the hackney library for all releases from 2.0.0 up to, but not including, 4.9.0. The library is maintained by benoitc and is widely used in Elixir and Erlang applications that perform HTTP calls. Systems that rely on older versions and use automatic redirect handling are subject to this flaw.

The CVSS score of 6 indicates moderate risk, and while the EPSS score is not reported, the vulnerability is not yet noted in the CISA KEV catalog. The attack requires a server that can send a redirect to a target on the same hostname but using a different scheme or port, which a malicious insider or compromised proxy could supply. Consequently, an attacker who can trick the client into following such a redirect can capture Basic Auth and cookie values and use them to authenticate to the original service or another local service.