The hapijs wreck library versions before 18.1.2 improperly handle credential headers during cross-origin redirects. While Wreck strips Authorization, Cookie, and Proxy-Authorization headers before following redirects, its origin check only compares hostnames and ignores scheme and port. This flaw permits credentials to be forwarded when redirects change the port or downgrade from HTTPS to HTTP on the same hostname. An attacker controlling a co-tenant on an adjacent port or able to forge redirects can capture sensitive credentials and impersonate the victim against upstream services. The vulnerability is addressed by updating to version 18.1.2.

An attacker capable of inducing a redirect to a same-host different port or HTTPS-to-HTTP downgrade can capture sensitive authentication credentials such as bearer tokens, session cookies, and proxy credentials. This enables impersonation of the victim user against the upstream service. The vulnerability does not impact availability or integrity but compromises confidentiality of sensitive information.

Upgrade hapijs wreck to version 18.1.2 or later, where this issue is fixed. Patch status is confirmed by the version fix noted in the description. No additional mitigations are specified.