libcurl can unintentionally send credentials from a .netrc file to a host that follows an HTTP redirect, when the original request and the redirected request share the same HTTP proxy and the connection is reused. This flaw, classified as exposure of sensitive information (CWE‑201), allows an attacker to obtain user passwords transmitted in clear text HTTP, thereby exposing authentication credentials and enabling credential theft.

The vulnerability affects libcurl and any applications that depend on it, such as the command‑line tool, when configured to use .netrc authentication and automatic HTTP redirects. All builds of libcurl that support .netrc usage and do not isolate proxy connections before the fix are potentially impacted; specific version numbers are not identified.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. Based on the description, it is inferred that the attacker would need to control or observe the clear text HTTP proxy used by the victim for both the original and redirected requests; once the proxy traffic can be seen or manipulated, the leaked credentials can be captured. Although exploitation requires a precise proxy configuration, the potential for credential theft warrants swift remediation.