The cpp-httplib HTTP client forwards Basic Auth, Bearer token, and Digest credentials to any host when following cross‑origin redirects (301, 302, 307, 308). This behavior allows an attacker who controls the redirect target to receive credentials sent in the Authorization header, potentially compromising authenticated sessions. The flaw falls under an information‑exposure weakness.

The issue affects the yhirose:cpp‑httplib library in all releases older than 0.39.0. Projects that include the library as a header‑only dependency are at risk unless they have upgraded to the patched version. The library’s single‑file nature means a simple inclusion of an old header can expose applications.

The CVSS score of 7.4 indicates high severity. No public exploitation reports are recorded and the vulnerability is not yet present in the CISA Known Exploited Vulnerabilities catalog, suggesting limited known usage. Nevertheless, any client communicating with a server that can issue a malicious redirect can be tricked into leaking credentials. The attack vector is a remote network attack relying on HTTP redirects, and the risk is significant for applications that rely on secure authentication.