The vulnerability lies in libcurl's handling of HTTP connections that use Negotiate authentication. When the initial request for a hostname is performed with empty credentials, libcurl mistakenly reuses that same connection for subsequent requests. As a result, a later request from a different user can be transmitted over the first user's authenticated connection, effectively leaking the authenticated session to the second user. This flaw involves CWE-488 and CWE-613.

The flaw affects libcurl, the library used by many client applications. The advisory does not specify particular versions; therefore any libcurl version that implements Negotiate authentication and has not applied the fix is potentially vulnerable.

The CVSS score of 9.8 shows a high severity. The EPSS score of 0.01162% indicates a low likelihood of exploitation. Exploitation requires that an attacker control or influence two distinct users: one must initiate a Negotiate authentication request with empty credentials, and the second user must subsequently send a request that can be routed over the reused connection. The vulnerability is not listed in the CISA KEV catalog. The attack vector can involve local or remote interactions, depending on how the client applications are used in the environment.