performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,
POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new
target host.
Metrics
Affected Vendors & Products
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Curl
Subscribe
|
Curl
Subscribe
|
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 09 Jan 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Fri, 09 Jan 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Thu, 08 Jan 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 08 Jan 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. | |
| Title | bearer token leak on cross-protocol redirect | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-01-09T19:25:30.460Z
Reserved: 2025-12-11T08:04:14.328Z
Link: CVE-2025-14524
Vulnrichment
Updated: 2026-01-08T11:06:18.117Z
NVD
Status : Awaiting Analysis
Published: 2026-01-08T10:15:46.607
Modified: 2026-01-09T20:15:51.243
Link: CVE-2025-14524
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-01-09T13:25:25Z
No weakness.