The Tesla middleware treats HTTP header names as case-sensitive when determining which headers to strip on cross-origin redirects, but the HTTP specification defines header names as case-insensitive. Because the library preserves the exact casing supplied by callers, a header set as "Authorization" does not match the lowercase filter value "authorization" and is therefore passed along to the redirect target. This flaw lets an attacker who can influence the Location response (e.g., by controlling their own endpoint or compromising an upstream service) receive bearer tokens or other sensitive credentials that were intended for the original origin. The vulnerability is classified as CWE‑178 (Improper Handling of Case Sensitivity).

The Elixir Tesla HTTP client library for Elixir, versions 1.4.0 through 1.18.2, is affected. Versions before 1.4.0 are not listed as vulnerable and updates through 1.18.3 and later include the fix.

With a CVSS base score of 8.2, this flaw is considered high severity. Although the EPSS score is not available, the vulnerability is not in the CISA KEV catalog, so exploit prevalence is uncertain. An attacker can exploit the issue by issuing or manipulating a cross-origin redirect that results in the client following a Location header to a third‑party domain. The leaked Authorization header can then be used for unauthorized access. The impact can range from compromised user accounts to full credential compromise, depending on the sensitive data contained in the header. Due to the lack of an EPSS metric, the likelihood remains unclear, but the potential for credential theft mandates immediate attention.