The FollowRedirect middleware incorrectly preserves Authorization and Cookie headers when a redirect occurs from HTTPS to HTTP within the same authority. This flaw allows sensitive credentials to be transmitted over an unencrypted channel, exposing them to anyone capable of observing the network traffic. The weakness is a manifestation of information disclosure and cryptographic protocol misuse.

The vulnerability affects the Http4s library across versions earlier than 0.23.35 and 1.0.0-M47. Applications built with these library releases and utilizing the FollowRedirect middleware are susceptible.

The CVSS score of 5.9 indicates moderate severity. EPSS score of 0.00235 (less than 1%) indicates a very low probability of exploitation. The flaw requires an attacker who can induce a downgrade redirect and observe the traffic, making the exploitation more situational. The vulnerability is not currently catalogued in the CISA KEV list. The likely attack vector involves manipulating application or network configuration to trigger an HTTPS to HTTP redirect while preserving credentials.