The vulnerability stems from libcurl’s connection cache match function not considering the automatic client certificate option. As a result, a connection that has already been authenticated – including any client‑provided certificate – can be unexpectedly handed off to a transfer that has been redirected to another origin, even though the code explicitly disables auto client certificates for that transfer. This flaw could allow a redirecting server to receive the client’s authentication credentials and potentially use them for further compromise.

Any libcurl build that uses the Microsoft Schannel TLS backend may be affected. No specific product version ranges are listed, so all such builds could be vulnerable until a patch is applied.

Based on the description, the likely attack vector involves an attacker controlling a server that can redirect the client to a malicious origin. The CVSS score of 7.5 indicates moderate to high severity, and a very low EPSS score of < 1% suggests limited evidence of exploitation as of the latest data. The vulnerability is not in the CISA KEV catalog. An attacker who can cause a redirect to a malicious origin could obtain the client’s credentials through the reused connection. Overall risk is moderate, and mitigation should be applied promptly.