LWP::UserAgent versions before 6.83 forward Authorization and Proxy-Authorization headers unchanged during 3xx redirects. When a redirect targets a host under attacker control, the caller’s credentials are sent to that host, exposing sensitive authentication information. The weaknesses are categorized as CWE‑201 and CWE‑522.

The flaw exists in all OALDERS LWP::UserAgent releases prior to 6.83. Users of libwww-perl older than 6.83 are affected. Upgrading to 6.83 or later removes the vulnerability.

Exploitation requires an application that uses LWP::UserAgent to request a URL that the attacker can influence, resulting in a redirect to an attacker‑controlled domain. The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% reflects a low probability of exploitation, but the potential for credential disclosure remains significant, warranting immediate action.