The RedirectHandler middleware in the Kiota libraries fails to remove Cookie, Proxy-Authorization, and any custom headers when following HTTP 3xx redirects to a different host or scheme. It only removes the Authorization header, permitting the attacker to gain unauthorized access to credential information and session data that is forwarded to a foreign destination. This flaw falls under CWE‑601, which describes the risk of using client‑side redirects to leak data to untrusted hosts.

Affected vendors include Microsoft, with libraries for Java, Go, TypeScript, and other Kiota abstractions. The specific product identified in the description is com.microsoft.kiota:microsoft-kiota-http-okHttp version 1.9.0, and analogous versions of the Kiota libraries across languages share the same flaw.

The CVSS score of 7 indicates a high potential for damage, while the EPSS score is not available, making the current exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector involves a server‑side request that initiates a redirect to an attacker‑controlled host; the redirect handler then forwards sensitive headers to that host, enabling credential theft or session hijacking. Proper input validation and header sanitization are required to mitigate the exploitation path.