The HTTP/3 redirect handler in hackney forwards all original request headers unchanged to any redirect target without performing a cross‑origin check. When a client issues a request with follow_redirect enabled and includes Authorization or Cookie headers, a 3xx redirect to another host will cause the client to resend those sensitive headers verbatim to the new origin, thereby leaking credentials. According to the CVE data, this flaw is classified as CWE‑601, indicating an open redirect leading to unintended data exposure.

The vulnerability affects the Erlang HTTP client library hackney from version 3.1.1 up to, but not including, 4.0.1. The affected product is benoitc hackney (Erlang).

The CVSS score of 6 denotes moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based: an attacker who can cause the client to follow a redirect to a domain under the attacker’s control may obtain the client’s Authorization or Cookie headers and thereby gain unauthorized access. exploitation requires the client to be configured to follow redirects and to send credentials, so it is contingent on the client’s settings but, once triggered, results in credential exposure.