Authorization Header Exposure in Libsoup HTTP Redirection

CVE-2025-46421

Summary

A security flaw exists in libsoup where clients improperly handle HTTP redirects. When a redirect occurs, these clients inadvertently send the HTTP Authorization header to the new host, potentially allowing that host to impersonate the user to the original server. This could lead to unauthorized access and exposure of sensitive information, highlighting the need for careful management of authorization credentials in HTTP transactions.

References