The HTTPPasswordMgr class and its subclasses in Python's urllib.request module did not consider the URL scheme when matching stored credentials to requested URLs. As a result, credentials stored for an HTTPS URL could be sent over HTTP requests to the same host, allowing an attacker who can redirect or downgrade connections to capture credentials in cleartext. Similarly, credentials stored for HTTP URLs could be sent over HTTPS requests. The fix scopes credential matching by URL scheme, ensuring credentials are only sent for requests with the same scheme. Credentials registered with a bare authority (without scheme) still match any scheme for compatibility. Users who cannot upgrade immediately are advised to avoid making HTTP requests to hosts with registered credentials to mitigate risk.

An attacker capable of redirecting or downgrading client requests from HTTPS to HTTP can intercept credentials sent in cleartext due to the flawed credential matching. This compromises the confidentiality of authentication credentials, potentially enabling unauthorized access. The vulnerability affects the security of HTTP authentication in Python applications using urllib.request, particularly when redirects or downgrade attacks occur.

No official fix or patch is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, users unable to upgrade should ensure their applications do not make plain HTTP requests to hosts for which credentials are registered, for example by avoiding following redirects to HTTP URLs. This reduces the risk of credential exposure due to downgrade or redirect attacks.