The vulnerability (CVE-2026-48595) in elixir-tesla tesla affects version 1.4.0 and involves Tesla.Middleware.FollowRedirects improperly handling case sensitivity when filtering security-sensitive headers on cross-origin redirects. The filter list uses lowercase header names ("authorization", "host") and compares them case-sensitively against headers as supplied by the caller, which preserves original casing. Since HTTP headers are case-insensitive, headers such as {"Authorization", "Bearer ..."} do not match the lowercase filter and are forwarded to the redirect destination. This can lead to leakage of bearer tokens or other authorization credentials to third-party origins if an attacker controls or influences the redirect location.

An attacker who can control or influence the Location header in a redirect response can receive sensitive authorization credentials (e.g., bearer tokens) forwarded to a third-party origin. This results in credential leakage and potential unauthorized access. The vulnerability has a high severity with a CVSS 4.0 score of 8.2, indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions or implement custom middleware to normalize header casing before redirects to ensure sensitive headers are properly stripped.