In Orange-OpenSource hurl versions 8.0.1 and earlier, the redirect handling logic in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host. However, cookies created from the dedicated [Cookies] section in the RequestSpec are carried into the redirected request regardless of host change. This behavior allows an attacker-controlled redirect to receive authentication or session cookies that should remain scoped to the original host, constituting an insertion of sensitive information into sent data (CWE-201). Cookies supplied through raw Cookie headers are not affected by this issue. The vulnerability is fixed in version 8.1.0.

An attacker who can control HTTP redirects may receive authentication or session cookies intended only for the original host, potentially leading to unauthorized access or session hijacking. However, the vulnerability requires user interaction (UI:A) and does not allow privilege escalation or code execution. The CVSS 4.0 base score is 6.9, indicating medium severity.

Upgrade to Orange-OpenSource hurl version 8.1.0 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory or description.