In specific scenarios involving HTTP redirects from secure to insecure endpoints, the Reactor Netty HTTP client may leak stored credentials when configured to follow redirects. This constitutes a confidentiality breach, as compromised credentials could enable unauthorized authentication to protected services. The weakness stems from improper handling of redirect chains, consistent with CWE-522.

The affected products are Spring’s Reactor Netty library. Vulnerable versions include 1.0.0 through 1.0.51, 1.1.0 through 1.1.35, 1.2.0 through 1.2.17, and 1.3.0 through 1.3.5. Organizations using any of these releases need to evaluate whether their applications permit automatic redirect following over HTTPS to HTTP redirects.

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to manipulate a client that follows redirects from a secure origin to an insecure one, typically by controlling the redirect target or by forging a malicious redirect response, thereby enabling credential disclosure. The risk therefore depends on the application's redirect policies and network context, but the lack of a high exploitation probability suggests that attackers would need directed access to the redirect flow.