The flaw in hurl’s redirect handling causes cookies defined in a [Cookies] section to be forwarded to an attacker‑controlled host when a redirect changes the target host. Authorization and raw Cookie headers are correctly stripped, but the dedicated cookie set is inadvertently carried over. This allows an attacker to obtain authentication or session tokens that would normally be scoped to the original domain, enabling unauthorized access or session hijacking. The weakness is a classic example of variable or session‑handling error (CWE‑201).

Orange‑OpenSource hurl, a command‑line HTTP testing tool. Versions 8.0.1 and earlier perform redirects by stripping standard Authorization and Cookie headers while still propagating the [Cookies] section, leading to the described leak. The issue was fixed in version 8.1.0, so any installation of hurl 8.0.1 or earlier is affected.

The CVSS score of 6.9 classifies the vulnerability as moderate. EPSS is currently unavailable, and the weakness is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. Based on the description, the likely attack path involves the attacker causing hurl to follow a redirect to a host under their control. When the redirect occurs, the cookie copy is transmitted, giving the attacker valuable credentials. The vulnerability can be exploited by any user who runs hurl against a target that triggers such a redirect, making it a practical concern for developers using automated HTTP tests.