In specific WebSocket handshake scenarios, when the Reactor Netty client follows an HTTP redirect to a different origin, the client leaks the credentials contained in the original request. The exposed information can be transmitted to an unintended third‑party origin, allowing an unauthorized actor to obtain authentication tokens or other sensitive data without code execution or system compromise.

Spring Reactor Netty versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier are impacted. Any application that instantiates a Reactor Netty WebSocket client and configures it to follow redirects falls within this scope.

The CVSS base score is 6.1, denoting a medium severity vulnerability. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires control over the redirect target in a WebSocket handshake, which may be limited in tightly regulated environments, though the potential for credential leakage warrants moderate concern.