When curl performs an HTTP(S) transfer using an OAuth2 bearer token and that transfer follows a redirect to a second URL, the client may inadvertently transmit the bearer token to the second host. Because curl associates the token with the original hostname, if the redirected-to hostname matches an entry in the user’s .netrc file (via the `machine` or `default` keyword), that token is added to the request for the second service. This results in accidental exposure of the bearer token, which can be used by an attacker to impersonate the user on a different service. The vulnerability is classified under CWE‑201 (Information Exposure) and CWE‑522 (Insufficiently Protected Credentials).

Affected product: Haxx’s curl library (denoted by cpe:2.3:a:haxx:curl). No specific version information is supplied in the current data set; users should consult the vendor advisories for patch details.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to control or influence the redirect URL that points to a hostname containing .netrc credentials while the client is making a bearer‑token request to the original host. The likely attack vector is a malicious redirect or misconfiguration that causes curl to forward sensitive credentials to an unintended host.