The flaw lies in libcurl's connection cache when using the Microsoft Schannel TLS backend. The connection cache fails to reassess client certificate authentication during HTTP redirects, allowing a malicious server to redirect a transfer to a different destination. In doing so, libcurl reuses an already authenticated connection and can expose the client’s certificate and credentials to an unintended origin, potentially leaking sensitive authentication data.

This issue affects any curl (libcurl) build compiled with the Microsoft Schannel TLS backend. No specific version range is provided, so all such builds may be susceptible.

The CVSS score of 3.7 indicates low severity, and the EPSS score is not available, suggesting limited evidence of exploitation. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker able to control a redirecting server can exploit the flaw to gain client certificates, which could aid in credential compromise or lateral movement. The overall risk is low to moderate, warranting attention but not immediate emergency response.