The Apache Juneau REST client fails to remove authentication headers when following an HTTP redirect, causing Authorization, Cookie, Proxy-Authorization, and X-API-Key headers to be sent to a different host, port, or protocol. This weakness, classified as CWE‑522, can lead an attacker who controls a redirecting server to capture valid credentials and gain unauthorized access to protected resources and services.

The vulnerability exists in Apache Juneau versions up to and including 9.2.0. Users of the Apache Software Foundation’s Apache Juneau product should be aware that any installation with a version identifier matching or older than 9.2.0 is susceptible.

The CVSS score of 10 indicates a critical impact. Because the EPSS score is not available, the likelihood assessment is uncertain, but the presence of this flaw in a widely used framework elevates concern. If an application sends sensitive requests through the RestClient and a redirect points to an untrusted domain or protocol, the credentials will be forwarded, giving the redirecting server the ability to impersonate the client or access privileged resources. This vector is most relevant to systems that rely on automatic redirect handling in the RestClient builder; custom HttpClient usage mitigates the risk if redirects are disabled or headers are stripped.