The flaw exists in libsoup, the HTTP library used by many Red Hat products. During an HTTP redirect, the library removes the user Authorization header but mistakenly keeps the Proxy‑Authorization header when the target host changes. This allows proxy credentials to be forwarded to third‑party servers. The vulnerability can expose sensitive authentication credentials, compromising the confidentiality of proxy traffic, and can be exploited by an attacker who can influence the redirect target. This is a credential leakage flaw classified as CWE‑201.

Red Hat Enterprise Linux 10 through 9 are impacted, as the underlying libsoup ABI is included in those distributions. The issue also affects any applications linked against the GNOME libsoup library. Versions of the library that coincide with the RHEL releases that ship before the fix are vulnerable.

The CVSS base score is 5.8, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Still, an attacker who can direct a user through a malicious proxy or control redirect responses could cause credential leakage. The exploit requires network access to produce redirects and the victim to use a proxy that involves the vulnerable libsoup library.