Wreck is an HTTP client utility that, prior to version 18.1.2, removes credential headers such as Authorization, Cookie, and Proxy-Authorization before following a cross‑origin redirect. However, the origin check compares only the hostname and disregards the URI scheme and port number, so credentials are forwarded unchanged across same‑host port changes and HTTPS‑to‑HTTP downgrades. This flaw permits a co‑tenant on an adjacent port or a network‑position attacker who can forge redirects to capture bearer tokens, session cookies, and proxy credentials, enabling impersonation of the original requester. The weakness stems from improper origin verification and corresponds to CWE‑319, CWE‑346, and CWE‑522.

The vulnerability affects the Hapi.js Wreck HTTP client versions prior to 18.1.2. Users who rely on Wreck for outbound HTTP requests—particularly in micro‑service or API gateway environments—are potentially exposed. The issue remains as long as code paths that perform redirects use the default behaviour of stripping headers based only on host comparison.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation, though the flaw is not flagged in the CISA KEV. Attackers would need to either control a co‑tenant service running on a neighboring port or position themselves to dictate redirect rules within the network. By exploiting the redirect flaw, they can obtain legitimate credentials and impersonate the client, compromising data confidentiality and integrity of downstream services. The absence of a KEV listing does not diminish the technical risk to affected installations.