The AsyncHttpClient library, used to perform asynchronous HTTP requests, permits redirect following. When enabled, headers that contain credentials, including Authorization and Proxy-Authorization, as well as the Realm object holding plaintext credentials, are forwarded to any redirect target. This occurs even when the redirect crosses origin boundaries or degrades from HTTPS to HTTP. Consequently, an attacker who controls a redirect target can capture Bearer tokens, Basic authentication credentials, or other Authorization header values, leading to unauthorized disclosure.

Java applications that use AsyncHttpClient async-http-client versions earlier than 3.0.9 or 2.14.5 and that enable redirect following are vulnerable. The issue exists in all projects that have not applied the fixed releases identified in the advisories.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of <1% indicates a low likelihood of exploitation. The vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, it is inferred that the primary attack vector is remote, exploiting HTTP redirects, open redirects, or other mechanisms that allow an attacker to control the redirect target. An adversary could obtain authentication tokens by redirecting client requests to a malicious server, potentially leading to credential compromise.