The vulnerability in Erlang OTP's inets httpc_response module arises because the httpc client forwards Authorization and Proxy-Authorization headers to redirect targets without checking if the redirect crosses an origin boundary. Specifically, the function httpc_response:redirect/2 updates only the host field in the header record, copying all other fields verbatim, including sensitive authorization headers. Since autoredirect defaults to true, any httpc caller not disabling automatic redirects is affected. An attacker controlling a server contacted by the victim can issue a cross-origin 3xx redirect to a malicious server, causing credential theft via forwarded Authorization headers. This affects OTP versions from 17.0 before 29.0.2, 28.5.0.2, and 27.3.4.13, and corresponding inets versions from 5.10 before 9.7.1, 9.6.2.2, and 9.3.2.6.

An attacker who controls a server that a vulnerable httpc client contacts can cause the client to send sensitive Authorization and Proxy-Authorization headers to a malicious redirect target. This can lead to credential theft, exposing sensitive data embedded in these headers. The vulnerability affects all clients using automatic redirects (enabled by default), increasing the risk of unauthorized disclosure of credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling automatic redirects in the httpc client to prevent forwarding authorization headers to untrusted redirect targets.