The vulnerability in LWP::UserAgent before version 6.83 involves insufficient protection of credentials (CWE-522). Specifically, during HTTP 3xx redirects, the module strips only Host and Cookie headers but leaves Authorization and Proxy-Authorization headers intact. This results in these headers being sent to the redirect destination regardless of cross-origin changes, potentially exposing sensitive authentication credentials to unauthorized parties if the redirect target is malicious.

An attacker controlling a redirect target can receive the caller's Authorization and Proxy-Authorization headers, leading to credential disclosure. This compromises confidentiality of authentication credentials used by the client application. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor or CPAN security advisories for updates. Until a fix is available, avoid following redirects to untrusted or attacker-controlled hosts when using vulnerable versions of LWP::UserAgent. Consider implementing manual redirect handling that strips sensitive headers or upgrading to version 6.83 or later once available.