The Hubuum Rust client library prior to version 0.6.1 uses reqwest's default redirect policy, which allows automatic following of HTTP 3xx redirects while retaining sensitive headers such as the bearer Authorization token if the redirect is within the same scheme, host, and port but changes the path. Although the BaseUrl setting constrains initial requests to a configured origin and path prefix, redirect processing occurs after this validation, allowing a redirect to a different path on the same origin to leak the Authorization header outside the intended API path. Exploitation requires an attacker, compromised server, or intermediary to influence a redirect response. Version 0.6.1 mitigates this by configuring reqwest clients with redirect policy set to none, returning 3xx responses as errors instead of following them automatically. Users can also opt-in to custom clients with different redirect policies. This vulnerability is tracked as GHSA-f45q-w629-wr25 and has a moderate severity rating.

Sensitive bearer Authorization headers may be leaked to unintended paths on the same origin due to automatic following of HTTP redirects that change only the path. This could expose authentication tokens to endpoints outside the configured Hubuum API path prefix, potentially leading to unauthorized access or information disclosure. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes. Exploitation requires control or influence over redirect responses.

A fixed version 0.6.1 of the Hubuum client library disables automatic redirect following by setting reqwest's redirect policy to none, causing 3xx responses to be returned as errors instead of followed. Users of affected versions (>=0.0.1 <0.6.1) should upgrade to 0.6.1 or later. Alternatively, users can construct a reqwest client with redirect policy set to none and supply it explicitly to the Hubuum client. Deployments should also ensure the Hubuum origin is not shared with other applications and that trusted infrastructure does not redirect API requests outside the configured path prefix to reduce exposure.