During an initial transfer that uses an ambient user for Negotiate authentication, if the transfer follows redirects, curl may transmit its credential details to a second, unrelated origin during the redirect. This inadvertent forwarding can expose Kerberos credential information to an unintended recipient, allowing an attacker to capture sensitive authentication data. The flaw is an information exposure vulnerability related to improper handling of authentication credentials across redirects.

Curl clients executing Negotiate (Kerberos) authentication and configured to follow redirects are affected. No specific product version is listed, so any version of curl that supports Kerberos authentication and automatic redirection could be vulnerable.

The CVSS score of 9.1 indicates high severity, and the EPSS score is < 1%, suggesting a very low exploitation probability. The vulnerability is not listed in CISA KEV, suggesting no widely known exploits have been documented yet. An attacker can exploit the flaw by acting as a malicious server that issues a redirect containing embedded user credentials; when the curl client follows the redirect, it inadvertently sends those credentials to an unrelated destination. The attack vector is inferred to be a remote server that controls the redirect target, leveraging the client’s trust in HTTP redirects.