In certain WebSocket handshake scenarios, when a client follows an HTTP redirect to a different origin, the Reactor Netty WebSocket client leaks user credentials that were included in the original request. The credential information can surface to the unintended origin, exposing it to an unauthorized party. This weakness aligns with "Exposure of Sensitive Information to an Unauthorized Actor." It does not grant the attacker code execution or control over the system, but it can compromise authentication tokens and other credentials.

Spring:Reactor Netty versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier are impacted.

The vulnerability has a CVSS score of 6.1, indicating a medium risk level. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation activity. Exploitation requires an attacker to influence or control the redirection target in a WebSocket handshake, which may be difficult in environments where redirects are tightly regulated. Nonetheless, the potential for credential loss warrants moderate concern, especially in high-value applications.