The urllib.request module’s HTTPPasswordMgr and its subclasses failed to enforce URL scheme checks when matching stored credentials against a requested URL. Credentials registered for an HTTPS site were also used for plain HTTP requests to the same host, meaning an attacker who can redirect or downgrade traffic (for example, via an HTTPS‑to‑HTTP redirect or an on‑path position) could capture those credentials in cleartext. This flaw represents an insecure transmission of credentials (CWE‑319) and inadequate credential scoping (CWE‑522).

Python Software Foundation’s CPython implementation is affected. All releases that still use the unpatched HTTPPasswordMgr are impacted until the fix that scopes credentials by URL scheme is applied. No specific version range is listed, so upgrade to any CPython version that incorporates this change.

The CVSS score is 6, indicating medium severity. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The practical attack requires an attacker to control network traffic or induce a redirect to a plain HTTP URL. If feasible, the credentials can be read in cleartext, so the risk is moderate and mitigated primarily by updating CPython.