CVEvulnerability

CVE-2026-86413

Published 2026-10-20 Modified 2026-10-22 Official page ↗
Status
Awaiting Analysis
Published
2026-10-20
Last modified
2026-10-22
Assigner
2499f714-1537-4658-8207-48ae4bb9eae9

Description

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

References