CVE-2025-46421CWE-497

Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server

Medium · published April 24, 2025

CVSS v3.1
6.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-04-24T13:01Z
EPSS history
Timeline
  • 24 APR 13:01Z
    Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
    cvelistv5