The vulnerability is an information disclosure flaw located in the RedirectMiddleware of guzzlehttp/guzzle. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header during a same‑scheme redirect. An attacker who can control the redirect target can read the fragment from the incoming Referer header, potentially leaking one‑time login secrets, access tokens, state values, or other confidential client data. The flaw is defined as CWE‑201, Information Exposure Through Vulnerable Design, and a flaw in the handling of sensitive data.

The affected product is the Guzzle HTTP client (guzzlehttp/guzzle) distributed by guzzle:guzzle. Versions prior to 7.15.1 are vulnerable; version 7.15.1 and later incorporate a fix that strips the fragment before generating the Referer header.

The vulnerability has a CVSS score of 8.2, indicating high severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network context in which a client is redirected to an attacker‑controlled URL; the attacker must have the ability to craft or influence the redirect. Once the redirect occurs, the client’s Referer header will expose the sensitive URI fragment to the malicious destination, constituting a significant data leakage risk.