The vulnerability in HTTP::Tiny before version 0.095 arises from insufficient protection of credentials during HTTP redirects. When a server responds with a 3xx redirect, HTTP::Tiny follows the Location header and re-applies the caller's headers to the new request without origin checks. This causes Authorization, Cookie, and Proxy-Authorization headers to be sent to potentially untrusted cross-origin hosts, including insecure downgrade scenarios from HTTPS to HTTP. The module's documentation incorrectly states that Authorization headers are not included in redirected requests, but this applies only to URL-userinfo Basic-auth, not explicitly set headers.

Sensitive credential headers may be leaked to unintended third-party hosts during HTTP redirects, potentially exposing authentication tokens or cookies. This can lead to credential compromise if an attacker controls or intercepts the redirect target, especially in downgrade scenarios from HTTPS to HTTP where credentials are transmitted in plaintext.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid passing sensitive headers explicitly when following redirects with HTTP::Tiny or implement manual redirect handling with origin checks to prevent credential leakage.