The vulnerability exists in Erlang OTP's httpc client. When an HTTP request encounters a 3xx redirect, the client copies the Authorization and Proxy-Authorization headers to the new request without verifying if the redirect target is on the same origin. This behavior allows an attacker who controls a redirect target to receive the victim's credentials, including Basic authentication derived from the URL userinfo. The flaw originates from httpc_response:redirect/2 updating only the host field of the header record and not checking the host against the original. As a result, credentials can be exfiltrated when a cross‑origin redirect occurs. The weakness constitutes a CWE‑601 Open Redirect that leads to Sensitive Data Exposure.

This issue affects Erlang:OTP versions prior to 29.0.2, 28.5.0.2, and 27.3.4.13, which correspond to inets releases before 9.7.1, 9.6.2.2, and 9.3.2.6. Users running OTP 17.0 through 28.5.0.1, 27.3.4.12, or earlier are vulnerable unless they have disabled automatic redirects. The vulnerability is present in the http_client component of OTP’s inets library.

With a CVSS score of 7.1, the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. An attacker who can influence the HTTP response from a server the victim contacts—such as by operating a malicious intermediate server—can issue a 3xx redirect to their own controlled domain. Because httpc’s autoredirect defaults to true, this occurs on all clients unless explicitly disabled. The internal logic of httpc_response:redirect/2 guarantees the forwarded Authorization header, making credential theft reliable. Therefore the likelihood of exploitation in environments where clients contact untrusted endpoints is significant.