A flaw in the Soupauthmanager component of the libsoup library allows proxy authentication credentials to be cached without tying them to the specific proxy authority (host:port). When the proxy configuration changes—through user action or automatic mechanisms such as WPAD—the cached Proxy‑Authorization headers intended for the previous proxy are sent to the new proxy. This unintentionally exposes credentials that were meant for a different proxy, potentially allowing the new proxy or any entity that intercepts the traffic to capture or reuse those credentials. The exposure remains limited to information disclosure and does not enable arbitrary code execution or service disruption.

The vulnerability affects Red Hat Enterprise Linux 10, which ships with libsoup for HTTP operations. Any system running this OS version that uses libsoup—whether in terminal or desktop applications—may be impacted when proxy settings are changed.

The CVSS score of 3.4 classifies this issue as low severity. The EPSS metric is reported as < 1 %, indicating an extremely low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited real‑world threat. The most likely attack vector involves a local user or privileged process that changes proxy settings; remote exploitation without a proxy switch is not feasible.