CVE-2025-14524CWE-522CWE-601

CVE-2025-14524

Medium · published January 8, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer

performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,

POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new

target host.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00680 · 51.8th percentile
Weaknesses
CWE-522 · Insufficiently Protected Credentials; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-01-08T15:15Z
Affected products (1)
ProductVersionsFixed in
haxx/curl≥ 7.33.0, < 8.18.08.18.0
References (4)
https://curl.se/docs/CVE-2025-14524.html · 2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2025-14524.json · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3459417 · 2499f714-1537-4658-8207-48ae4bb9eae9http://www.openwall.com/lists/oss-security/2026/01/07/4 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 08 JAN 10:07Z
    bearer token leak on cross-protocol redirect
    cvelistv5