Excon, a lightweight Ruby HTTP client, contained a bug in its RedirectFollower middleware that did not remove sensitive headers when following redirects. The flaw allowed any header present in the original request—such as authentication tokens, session identifiers, or other privileged data—to be forwarded to the redirect target, exposing confidential information that was not intended for that domain. This is an information‑exposure vulnerability classified as CWE‑201.

Ruby applications that employ the Excon gem before version 1.5.0 are vulnerable. Any software that imports Excon and performs HTTP requests with automatic redirect following enabled, without customizing a list of headers to strip, can inadvertently leak those headers to the redirect destination. This includes web applications, API clients, and scripts that rely on Excon's default redirect handling.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation generally requires an attacker to influence or control the redirect target so that the application forwards its request headers to an attacker‑controlled domain, thereby exfiltrating sensitive data without user awareness. The primary risk is to confidentiality; availability is not affected.