LWP::UserAgent versions before 6.83 forward Authorization and Proxy-Authorization headers unchanged during 3xx redirects. When a redirect targets a host under attacker control, the caller’s credentials are sent to that host, exposing sensitive authentication information. The weakness is categorized as CWE‑522.

The flaw exists in all OALDERS LWP::UserAgent releases prior to 6.83. Users of libwww-perl older than 6.83 are affected. Upgrading to 6.83 or later removes the vulnerability.

Exploitation requires an application that uses LWP::UserAgent to request a URL that the attacker can influence, resulting in a redirect to an attacker‑controlled domain. Although no CVSS score is publicly disclosed and the EPSS score is not available, the potential for credential disclosure is significant, warranting immediate action.