The AsyncHttpClient (AHC) library allows Java applications to execute HTTP requests asynchronously. Versions 2.14.5 through 2.16.0 and 3.0.9 through 3.0.11 contain a vulnerability where a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin redirect. This happens because the authentication interceptors fall back to the client-wide configuration after the per-exchange realm is cleared during redirect handling. If the redirected-to server is attacker-controlled and returns a 401 response, the client may send sensitive authentication credentials (Basic, Digest, Negotiate, or NTLM) to that origin. Per-request realms are handled correctly, so this is a residual bypass of previous cross-origin credential-stripping fixes. The vulnerability is resolved in versions 2.16.1 and 3.0.12.

An attacker controlling a redirect target can cause the client to send sensitive authentication credentials to an unauthorized origin after a cross-origin redirect. This leads to exposure of sensitive information (credentials) without impacting integrity or availability. The CVSS score is 6.8 (medium severity) with high confidentiality impact and no integrity or availability impact.

Upgrade AsyncHttpClient to version 2.16.1 or later, or 3.0.12 or later, where this vulnerability is fixed. No other mitigations are specified or required as the fix addresses the root cause.