The vulnerability exists in the RedirectHandler middleware of microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0 and earlier). When the client follows HTTP 3xx redirects to a different host or scheme, it strips only the Authorization header but forwards other sensitive headers like Cookie, Proxy-Authorization, and custom headers. This improper handling of headers during redirects can cause sensitive information to be sent to untrusted external sites, constituting an open redirect issue categorized under CWE-601.

Sensitive HTTP headers beyond Authorization, including Cookie and Proxy-Authorization, may be leaked to untrusted redirect targets during HTTP 3xx redirects. This can expose authentication tokens or session information to potentially malicious sites, increasing the risk of unauthorized access or session hijacking. The CVSS 4.0 score of 7 indicates a high severity with network attack vector, low attack complexity, and partial user interaction required.

No official patch or remediation level is currently confirmed for this vulnerability. Users of microsoft/kiota-java versions prior to 1.9.1 should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, avoid following redirects to untrusted hosts or manually inspect and sanitize headers when handling redirects in affected versions.