Gitoxide versions 0.25.0‑0.25.4 can send stored authentication tokens to any server that an attacker controls when an HTTP redirect occurs. The credential validation logic compares the original request URL to the credentials supplied, ignoring the final URL after a redirect. This flaw allows an attacker to construct cross‑domain redirects or downgrade HTTPS traffic to HTTP so that the client inadvertently transmits its authentication token to a malicious endpoint. A successful exploitation results in disclosure of valid credentials, which could be used to access private repositories or compromise the attacker’s account on Git hosts.

The vulnerability affects GitoxideLabs gitoxide released through version 0.25.4. No specific patch version is listed in the advisory; the fix is implied to be in later releases. Systems running any of these affected versions of gitoxide are at risk.

The CVSS score of 7.6 indicates a high severity and the lack of an EPSS entry means the probability of exploitation is currently unknown but could be significant if an attacker controls a redirect path. The vulnerability is not yet listed in CISA’s KEV catalog, suggesting no widespread public exploitation has been identified. Attackers would need the ability to influence a redirect that the gitoxide client follows, such as by providing a malicious repository URL or by controlling a proxy or server that performs the redirect. Once the client follows the redirect, the credentials are sent to the attacker’s endpoint, exposing the token.