{"id":"CURL-CVE-2026-86413","summary":"Negotiate credentials sent to redirected origin","details":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there.","aliases":["CVE-2026-86413"],"modified":"2026-10-14T07:04:25.332255896Z","published":"2026-10-14T08:00:00Z","database_specific":{"www":"https://curl.se/docs/CVE-2026-86413.html","issue":"https://hackerone.com/reports/3993549","CWE":{"id":"CWE-201","desc":"Information Exposure Through Sent Data"},"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-86413.json"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"8f71d0fde515aa4c68002477356c35bd79927729"},{"fixed":"43029e2ec37eba2354ced199ccd8898de695858e"}]}],"versions":["8.22.0","8.21.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-86413.json","vanir_signatures":[{"digest":{"function_hash":"197484543705449537405576979917654205683","length":1414},"id":"CURL-CVE-2026-86413-1e93bc7f","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/43029e2ec37eba2354ced199ccd8898de695858e","target":{"function":"url_attach_existing","file":"lib/url.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/43029e2ec37eba2354ced199ccd8898de695858e","target":{"file":"lib/url.c"},"deprecated":false,"digest":{"line_hashes":["187364918574459101311412106745538592488","264975616631119401330704202978605564609","317586723021531035471710209410329204294","191577447307436254778621372265599242980","177312209620819793276913791421236844650","137629164407106226757418211430020627125","41976915244105234222538516649574510234","23352433916399309512248611259609034193"],"threshold":0.9},"id":"CURL-CVE-2026-86413-cdc88345","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-14T07:04:25Z"}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}