curl receives an HTTP redirect to a URL containing user credentials (username:password). The bug causes curl to incorrectly retain and re‑transmit the original host’s Negotiate authentication state, sending a newly minted Kerberos ticket to the redirected host. A malicious server can trigger a redirect that includes arbitrary userinfo, forcing curl to transmit the Kerberos ticket to an untrusted third‑party host, thereby bypassing the usual domain‑scoping restrictions that deny cross‑domain ticket forwarding.

The vulnerability affects curl, the command‑line HTTP client, and any applications that embed its libraries. Versions that implement automatic redirect handling are potentially impacted; no specific version numbers are listed in the available data.

Based on the description, the likely attack vector is inferred to involve a malicious attacker hosting a website that issues an HTTP redirect containing arbitrary user credentials. The curl client, which automatically follows redirects, may then send its Negotiate authentication token to the new host. The CVSS base score of 9.1 classifies this as high severity. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers need a system running curl with active Kerberos credentials and no explicit --location-trusted flag; successful exploitation would result in the inadvertent leakage of a Kerberos ticket to an untrusted third‑party host, exposing the client’s authentication context.