The vulnerability arises because the HTTP/3 redirect handler in hackney (hackney_h3.erl) forwards original request headers, including sensitive Authorization or Cookie headers, to redirect targets without verifying if the new location is trusted. This contrasts with the main hackney module, which uses maybe_strip_auth_on_redirect/2 guarded by a location_trusted option to prevent such leaks. As a result, when a client follows a 3xx redirect to a different host with follow_redirect enabled, credentials may be sent to an untrusted origin, exposing sensitive data. This affects hackney versions from 3.1.1 up to but not including 4.0.1.

An attacker controlling or influencing redirect targets can cause clients using vulnerable hackney versions to send sensitive credentials (Authorization or Cookie headers) to untrusted third-party hosts. This leads to sensitive data exposure. There is no indication that this vulnerability allows privilege escalation or direct code execution, but it compromises confidentiality of authentication tokens or cookies during HTTP/3 redirects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling HTTP/3 redirect following or avoid using the vulnerable hackney versions. Monitoring for updates from the benoitc project is recommended to apply any forthcoming patches or official mitigations.