Contao's crawler attempts to prevent confidential HTTP client options from being sent to external domains by creating a scoped client with cleaned options. However, the cleaning function incorrectly removes non-existent option keys 'basic_auth' and 'bearer_auth' instead of the actual Symfony HttpClient options 'auth_basic' and 'auth_bearer'. As a result, when Basic or Bearer authentication is configured, these credentials remain in the client used for external links. An attacker can exploit this by embedding a link to an external URL that the crawler visits, causing the crawler to send its authentication credentials to the attacker-controlled host. The issue is due to a coding error in the option cleaning logic and insufficient test coverage. The recommended fix is to strip the correct Symfony authentication option keys, including 'auth_basic', 'auth_bearer', and 'auth_ntlm'.

The vulnerability leads to the disclosure of crawler Basic or Bearer authentication credentials to external hosts visited by the crawler. If these credentials protect sensitive environments such as staging or pre-publication sites, an attacker can gain unauthorized access to those environments. The severity is rated low (CVSS 2.6) because exploitation requires the attacker to induce the crawler to visit a malicious external URL and the credentials are limited to those configured for the crawler. There is no known exploitation in the wild.

A patch is available that correctly removes the Symfony HttpClient authentication options ('auth_basic', 'auth_bearer', 'auth_ntlm') from the cleaned client options used for external hosts. Users should update Contao to a fixed version at or beyond 5.3.47 or 5.7.7, depending on their version branch. Additionally, the factory test should be updated to properly verify that authentication options are not sent to external domains. Until patched, avoid enabling the broken-link checker with crawler authentication configured or restrict crawler access to trusted domains only.