When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via… (CVE-2026-87861)

This vulnerability occurs when ambient user credentials are used in HTTP requests. Specifically, an HTTP request directed to one origin might be sent over a connection that was previously authenticated via Negotiate for a different origin. As a result, the request does not use the intended credentials for the target origin, potentially leading to unintended credential usage.

The impact is that HTTP requests may be dispatched with credentials intended for a different origin, which could lead to unintended credential exposure or misuse. However, no specific exploitation details or active exploits are reported. The vulnerability could affect authentication integrity between origins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time.