Description (CNA)
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| curl / curl | affected 8.22.0 through 8.22.0; affected 8.21.0 through 8.21.0 |
CWE
No CWE identifiers supplied.