CVE-2026-86413

Discovered by AISLEPUBLISHEDCWE-201

Description

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

CVSS Base Scores

CVSS v3.1(Primary)
3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersionStatus
curl——

References