The AsyncHttpClient library, used by Java applications to perform HTTP requests, forwards Authorization and Proxy-Authorization headers to any redirect target when redirect following is enabled. This occurs even when the request crosses origin boundaries—different host, scheme, or port—or when the connection downgrades from HTTPS to HTTP. The library also propagates the Realm object that stores plaintext credentials, causing re‑generation of Basic or Digest authentication values during a redirect. An attacker who controls a redirect target, for example through an open redirect, DNS rebinding, or an HTTP man‑in‑the‑middle, can capture Bearer tokens, Basic auth credentials, or other Authorization header values. This results in an unauthorized disclosure of user credentials, classified under CWE‑200.

Java applications that use AsyncHttpClient (async-http-client) with redirect following enabled and that are running versions earlier than 3.0.9 or 2.14.5 are vulnerable. The issue affects any project that imports the library without upgrading to the fixed releases.

The CVSS score of 6.8 indicates moderate severity, and the vulnerability is not currently listed in CISA's KEV catalog. Although the EPSS score is unavailable, the exploit would require an attacker to control a redirect target, which is a realistic scenario for applications that do not validate redirect URLs. With the vulnerability in effect, an adversary could capture sensitive authentication tokens by redirecting requests to a malicious server, potentially leading to credential compromise. The main attack vector is remote, leveraging HTTP redirects or open redirects to coerce the client into sending credentials to an attacker‑controlled domain.