The hapijs wreck HTTP client utility versions before 18.1.2 improperly handle credential headers during cross-origin redirects. While Wreck strips Authorization, Cookie, and Proxy-Authorization headers before following redirects, the origin check only compares hostnames and ignores scheme and port. This flaw allows credentials to be forwarded intact when redirects occur between different ports on the same host or from HTTPS to HTTP. An attacker positioned on an adjacent port or able to forge redirects can capture sensitive credentials and impersonate the victim against upstream services. The vulnerability is addressed in version 18.1.2.

Sensitive authentication credentials such as bearer tokens, session cookies, and proxy credentials can be exposed to attackers capable of forcing redirects across ports or downgrading HTTPS to HTTP. This exposure allows attackers to impersonate victims to upstream services, potentially compromising user sessions and access controls. The CVSS score of 6.5 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact.

Upgrade to hapijs wreck version 18.1.2 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the description stating the fix is in version 18.1.2.