LWP::UserAgent versions prior to 6.83 for Perl improperly handle HTTP 3xx redirects by not removing Authorization and Proxy-Authorization headers before following the redirect. While the redirect handler removes Host and Cookie headers, it leaves these sensitive authentication headers intact, allowing them to be sent to potentially malicious redirect destinations. This behavior can lead to credential leakage if the redirect points to an attacker-controlled host. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) and has a CVSS 3.1 base score of 6.5, indicating a medium severity network attack vector with low attack complexity and no user interaction required.

The vulnerability allows an attacker controlling a redirect destination to receive the victim's Authorization and Proxy-Authorization headers, potentially exposing sensitive credentials. This can lead to unauthorized access to resources or services that rely on these credentials. There is no indication of impact on integrity or availability, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid following redirects to untrusted or attacker-controlled hosts when using vulnerable versions of LWP::UserAgent. Consider implementing manual redirect handling that strips sensitive headers or upgrading to a version confirmed to have addressed this issue once available.