The vulnerability allows PHP’s http:// stream wrapper to forward Authorization, Cookie, and Proxy-Authorization headers across redirects to a different host, port, or when downgrading from HTTPS to HTTP. This can result in credentials intended for an original origin being unintentionally sent to an attacker-controlled target, exposing sensitive authentication data.

PHP Group’s PHP implementation is affected. No specific product versions are listed, so all PHP installations that use the http:// stream wrapper are potentially impacted until a fix is applied.

The CVSS score of 5.9 indicates a moderate threat level. No EPSS score is reported, and the issue is not yet listed in the CISA KEV catalog. An attacker with the ability to force an application to redirect to a malicious URL can exploit this flaw to steal credentials. The risk remains contingent on whether the redirect target can be influenced for a given deployment.