Riskcovery

CVE-2025-14524

bearer token leak on cross-protocol redirect

State
Published
Severity
5.3 Medium
Published
Jan 8, 2026
Updated
Sep 15, 2026
Reserved
Dec 11, 2025

Read the record on cve.org

Description

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NCISA-ADP

Weaknesses

  • CWE-522 Insufficiently Protected Credentials

Affected Products

ProductVersions
curlcurl
  • 7.33.0 to before 8.14.2Affected
  • 8.15.0 to before 8.16.1Affected
  • 8.17.0 to before 8.18.0Affected
curlcurl
  • 06c1bea72faabb6fad4b7ef818aafaa336c9a7aa to before 1a822275d333dc6da6043497160fd04c8fa48640Affected
curlcurl
  • 8.17.0Affected
  • 8.16.0Affected
  • 8.15.0Affected
  • 8.14.1Affected
  • 8.14.0Affected
  • 8.13.0Affected
  • 8.12.1Affected
  • 8.12.0Affected
  • 8.11.1Affected
  • 8.11.0Affected
  • 8.10.1Affected
  • 8.10.0Affected
  • 8.9.1Affected
  • 8.9.0Affected
  • 8.8.0Affected
  • 8.7.1Affected
  • 8.7.0Affected
  • 8.6.0Affected
  • 8.5.0Affected
  • 8.4.0Affected
  • 8.3.0Affected
  • 8.2.1Affected
  • 8.2.0Affected
  • 8.1.2Affected
  • 8.1.1Affected
  • and 82 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.