VYPR
← All advisories
Unrated severityOSV Advisory· Published Jan 8, 2026· Updated Apr 2, 2026

bearer token leak on cross-protocol redirect

CVE-2025-14524

Description

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Affected products

2
  • Curl/CurlOSV2 versions
    curl-7_33_0, curl-7_34_0, curl-7_35_0, …+ 1 more
    • (no CPE)range: curl-7_33_0, curl-7_34_0, curl-7_35_0, …
    • (no CPE)

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.