The vulnerability arises when libgit2's HTTP transport follows an offsite initial redirect. During the redirect, the callback receives the original URL instead of the redirected host's URL. If the original URL is trusted, the callback may supply plain‑text credentials. libgit2 then stores those credentials and transmits them to the redirected host as an Authorization header. An attacker that controls the redirect target—or a trusted Git host that can issue an open redirect—therefore can retrieve HTTP Basic credentials, personal access tokens, or equivalent secrets. This leads to credential disclosure and violates confidentiality.

The flaw is present in the libgit2 library itself. Any application that links against libgit2 before version 1.8.6 or 1.9.5 is vulnerable. The issue was fixed in those releases, so any software using libgit2 1.8.6 or newer, or 1.9.5 or newer, is no longer affected. Developers of custom Git tools or services that embed libgit2 should verify that their binaries use a patched version.

The CVSS base score is 6.5, reflecting moderate severity. The EPSS score of 0.00469 (~0.47%) suggests a low probability of exploitation, but the vulnerability can still be leveraged when an attacker can influence the HTTP redirect chain, such as by hosting a malicious Git service or exploiting an open redirect on a trusted host. The issue is not listed in CISA KEV, indicating that widespread exploitation has not yet been observed. Nonetheless, because the disclosure of credentials can lead to compromised accounts or systems, the risk should be considered significant, especially in environments where libgit2 is used to communicate with untrusted or potentially compromised hosts.