The vulnerability arises because the httpc_response:redirect/2 function in Erlang OTP's inets httpc client copies all HTTP headers, including Authorization and Proxy-Authorization, verbatim to redirected requests without validating if the redirect target is within the same origin. Since autoredirect is enabled by default, any httpc caller that does not disable automatic redirects is affected. An attacker controlling a server contacted by the victim can issue a cross-origin 3xx redirect to another attacker-controlled server, causing the victim's credentials in Authorization headers to be leaked to the attacker. This issue affects OTP versions from 17.0 before OTP 29.0.2, 28.5.0.2, and 27.3.4.13, and corresponding inets versions from 5.10 before 9.7.1, 9.6.2.2, and 9.3.2.6.

An attacker who controls a server that a victim's httpc client contacts can exploit the open redirect to steal sensitive credentials contained in Authorization and Proxy-Authorization headers. This leads to sensitive data exposure and potential unauthorized access to resources. The vulnerability affects all httpc clients with automatic redirects enabled (default setting), increasing the risk of credential theft in cross-origin redirect scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling automatic redirects in the httpc client to prevent forwarding sensitive headers to untrusted redirect targets. Monitor Erlang OTP vendor advisories for updates and apply official patches once released.