HTTP::Tiny versions earlier than 0.095 forward Authorization, Cookie, and Proxy-Authorization headers to any redirect target without validating the target’s origin. This credential-exposure flaw allows an attacker who can influence a 3xx redirect response to capture sensitive authentication tokens or session cookies, potentially leading to account takeover or privilege escalation. The weakness is a credential-management issue (CWE-522).

The affected library is HAARG:HTTP::Tiny. Any version before 0.095 is affected, including releases that include 0.094 and earlier. The vendor advisory recommends upgrading to the 0.095-TRIAL release or a later version.

The CVSS score of 7.1 indicates a high severity, primarily due to confidentiality impact if credentials are sent to untrusted hosts. The EPSS score of less than 1% suggests that real-world exploitation is currently low but not impossible. The vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is triggered when an attacker can supply or modify a redirect response, the likely attack vector involves an attacker controlling the target server or manipulating traffic to insert a malicious redirect destination. No direct remote code execution is involved, but credential leakage can lead to broader compromise.