Curl contains a flaw that allows ambient user credentials—where authentication occurs implicitly—to be misused by reusing an existing Negotiate‑authenticated connection for a different server origin. Consequently, an HTTP request intended for one origin can be sent over a connection that is authenticated to another, meaning the legitimate credentials for the request are not used. This unintended cross‑origin reuse can expose sensitive data on the target server or cause the target to receive requests bearing different credentials, leading to information disclosure and potential authentication spoofing. The weakness is identified as CWE‑201, representing unauthorized information disclosure through improper handling of credentials.

The vulnerability affects the curl application and its libraries; no specific version range is provided, indicating that all releases prior to a later patch may be impacted. Any system that uses curl for HTTP(S) requests under environments where Negotiate authentication is enabled and where ambient credentials are in use is at risk.

The CVSS score of 9.1 indicates a high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is unlikely at present. Attackers would need to convince a user running curl to perform a request that uses ambient credentials, after which the connection could be abused to send data to an unintended third‑party server. The lack of an exploit score and KEV listing further mitigates immediate concern, but the risk of accidental information disclosure remains. Vigilance and mitigation are advised.