A flaw in libcurl causes the URL reported by CURLINFO_EFFECTIVE_URL to include embedded credentials, even when the original request URL and any redirect URLs do not contain them. As a result, if an application or script retrieves and logs or discloses this value, user credentials may be inadvertently exposed. The weakness arises from improper handling of authentication data during URL resolution, which can leak sensitive information to users or processes that capture the URL string.

Applications that link against libcurl, such as the curl command‑line client or any software that uses libcurl for HTTP networking, are affected. Any deployment running libcurl without the patch that fixes this issue may expose credentials if the effective URL is accessed. No specific version numbers are listed in the data, so all releases of libcurl prior to the fix are potentially vulnerable.

The exploitation process requires no complex preparation beyond the application’s use of CURLINFO_EFFECTIVE_URL. Attackers can read the leaked credentials if they gain the same level of access the application has to its logs or outputs. The EPSS score of <1% indicates that the probability of exploitation is very low, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, because the vulnerability has a CVSS score of 7.5 and exposes sensitive credentials, the risk to organizations is moderate to high, especially for applications that log or display the URL.