hubuum_client versions >=0.3.0 <0.6.1 allow bypass of configured custom transports for certain client operations such as password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams. This results in direct network requests using the built-in reqwest client, circumventing security boundaries established by custom transports. The vulnerability can expose plaintext credentials and bearer tokens outside the intended transport, and evade audit and routing policies. The issue does not affect applications that do not configure a custom transport. The proposed fix ensures all client calls route through the configured transport and disables redirect following in built-in clients to preserve security controls.

Applications using custom transports for security purposes (network isolation, proxy enforcement, request signing, audit logging, or policy enforcement) may have these controls bypassed for several client operations. This can lead to exposure of plaintext passwords and bearer tokens outside the intended secure transport, and allow network requests to evade audit and routing policies. The vulnerability affects versions >=0.3.0 <0.6.1 of hubuum_client. Applications not using custom transports are not impacted.

A fix has been proposed that routes all authentication, discovery, probe calls, export downloads, unified-search streams, raw and typed requests through the configured custom transport in both async and blocking clients. It also disables redirect following in built-in clients to maintain endpoint validation. Users should upgrade to version 0.6.1 or later once available to apply this fix. Until then, avoid using custom transports or carefully review network traffic to detect bypasses. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.