CVE-2026-82255: gitoxide 0.25.4 HTTP Credential Leak via Redirect
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of gitoxide 0.25.4 or later that use the curl-based HTTP transport backend with authentication credentials are exposed when connecting to a server that can redirect requests. The primary risk is credential disclosure to an attacker-controlled redirect destination.
What must an attacker be able to do to exploit it?
An attacker needs to cause an authenticated HTTP request to follow a redirect to an attacker-controlled server, potentially across domains or from HTTPS to HTTP. User interaction is required according to the CVSS vector.
Can redirects to non-HTTPS destinations expose credentials?
Yes. The described flaw allows credentials to be sent after HTTPS-to-HTTP downgrade redirects as well as cross-domain redirects, which can expose authentication tokens to the redirect target.