Contao’s crawler inadvertently exposes authentication credentials to external hosts. The crawler’s logic purges Cookie and Authorization headers correctly, but mistakenly retains the raw basic_auth and bearer_auth option names instead of the Symfony HttpClient’s auth_basic and auth_bearer options. As a result, when the crawler is configured with Basic or Bearer authentication for protected sites, those credentials are sent on the “clean” client used for external links or additional URIs. This constitutes an information‑disclosure flaw (CWE-200) that can reveal user credentials to malicious parties.

The vulnerability affects the Contao CMS for version ranges 4.13.40 through 5.3.46 and 5.7.0‑RC1 through 5.7.6. The issue was remediated in Contao 5.3.47 and in 5.7.7.

The CVSS score of 2.6 indicates low severity, and the EPSS score is reported as less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to trigger the crawler to request an external URL, for example by placing a link on a crawled page while the broken‑link checker feature is active. When that occurs, the crawler sends the compromised credentials to the external host, enabling credential theft.