An application that uses libcurl for authenticated HTTP(S) requests may incorrectly reuse a connection established with Negotiate authentication. This weakness, identified as CWE-488 and CWE-613, allows a second request to a host to be sent over the same connection that was authenticated with different credentials, effectively bypassing authentication. The primary consequence is that an attacker could access resources or information that should be restricted to another user.

Any software linked against libcurl and performing Negotiate‑authenticated calls to the same host is potentially vulnerable. No specific vendor, product, or version information has been disclosed, so the risk applies broadly to libcurl‑based applications that reuse connections across authentication contexts.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote; an attacker could manipulate the target application’s HTTP requests or control the destination host to trigger the flawed reuse. The lack of an exploit probability score and KEV status means the likelihood of exploitation remains uncertain, but the impact of a successful bypass warrants timely remediation.