Tornado’s SimpleAsyncHTTPClient shallow‑copies redirected requests and only removes the Host header, leaving Authorization, auth_username, auth_password, and auth_mode intact when the redirect changes scheme, host, or port. Consequently, sensitive authentication information can be forwarded to unintended destinations during cross‑origin redirects. This unauthorized disclosure of credentials aligns with CWE‑200.

The flaw affects any deployment of the Tornado framework that uses versions earlier than 6.5.6. Clients, routers, or applications built with these releases that perform HTTP requests with the SimpleAsyncHTTPClient may inadvertently forward credentials across cross‑origin redirects. All versions dating before the 6.5.6 release version are vulnerable.

The vulnerability has a CVSS score of 7.7, indicating a high severity risk. The EPSS score of less than 1% suggests that, currently, exploitation is unlikely but not impossible. It is not listed in CISA’s KEV catalogue. Attackers can target applications that issue cross‑origin redirects via HTTP, redirecting requests to attacker‑controlled hosts to capture the leaked Authorization header. The attack would require the ability to influence the redirect location or to intercept the traffic, making it more plausible in environments where users can supply arbitrary URLs.