CVE-2025-46421: Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
Other sources
Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
— Microsoft
When encountering an HTTP redirect, libsoup clients prior to version 3.6.5 send the HTTP Authorization header to the host that is the target of the redirection, allowing this host to impersonate the user to the host that performed the redirect.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsoup3to a version that resolves this vulnerability.Fixed in 3.6.5-1 - Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.6.5 - Compensating control
If you cannot upgrade, mitigate by preventing Authorization/credential-bearing requests from being followed across HTTP redirects (e.g., configure the client/network so redirects to a different host are not automatically followed with the same Authorization header).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46421?
CVE-2025-46421 has a moderate severity rating due to the potential for unauthorized user impersonation.
How do I fix CVE-2025-46421?
To fix CVE-2025-46421, update your libsoup to version 3.6.5 or later, which addresses this vulnerability.
What software is affected by CVE-2025-46421?
CVE-2025-46421 affects the GNOME libsoup library versions prior to 3.6.5.
What does CVE-2025-46421 allow an attacker to do?
CVE-2025-46421 allows attackers to impersonate users by capturing their HTTP Authorization header during redirects.
When was CVE-2025-46421 reported?
CVE-2025-46421 was reported as a flaw in libsoup and is currently cataloged for public awareness.