libcurl contains a flaw in its connection‑reuse logic when handling Negotiate authentication. The bug can cause a request that authenticates a connection with user1 credentials to be reused for a subsequent request that supplies user2 credentials. Because Negotiate can authenticate connections rather than individual requests, the library mistakenly believes the connection is already authenticated and forwards the second request on the same socket, enabling the second client to access the server’s resources as user1. This is an improper authentication weakness, corresponding to CWE‑305. The result is that an attacker can gain unauthorized access to data or services that are protected by a different user’s credentials.

The vulnerability affects the curl:curl product, i.e., libcurl. No specific product‑version range is listed in the CVE record, so all releases prior to the fix are potentially impacted. The affected platform is identified by the CPE string cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*.

The CVSS base score is 6.5, which classifies the issue as Medium severity. The EPSS score is reported as less than 1 %, indicating a low probability that the vulnerability will be actively exploited at any given time. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector involves an application that performs two Negotiate‑authenticated requests to the same server with different credentials; an attacker who controls the application or its configuration can drive the second request to reuse the prior connection, achieving unauthorized access. Exploitation requires the client to make both requests to the same server while the original connection remains open, and does not require any special permissions or lateral movement once the client is compromised.