A bug in the curl utility, classified as CWE-200, causes it to keep and forward authentication data when processing HTTP redirects that contain user credentials. If a server redirects a curl‑based client to an untrusted address, the client will transmit secrets such as Kerberos tickets to that new location. This flaw can expose previously protected authentication tokens, resulting in unauthorized information disclosure across domain boundaries.

The vulnerability affects the curl command‑line tool and any libraries that rely on curl for HTTP transport. All versions that implement automatic redirect handling are potentially impacted, although no specific version numbers are listed in the available data.

The CVSS base score is 3.1, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by hosting a malicious site that issues a redirect to a second domain; the curl client will then unknowingly forward credentials to the attacker. The risk is confined to environments where curl automatically follows redirects and contains user credentials in the URL.