Negotiate Authentication Redirect Vulnerability in Curl

CVE-2026-86413

What is CVE-2026-86413?

This vulnerability in Curl arises when ambient user credentials are utilized during an initial transfer with Negotiate authentication. If a redirect is requested, Curl could inadvertently forward sensitive authentication details to an unrelated second origin, potentially exposing user credentials and increasing the risk of unauthorized access.

References