Threats affecting pkg:github/libwww-perl

CVE-2026-8368 is a vulnerability in OALDERS LWP::UserAgent versions before 6.83 for Perl where Authorization and Proxy-Authorization headers are leaked during cross-origin redirects. The redirect handler fails to strip these sensitive headers on 3xx responses, sending them unchanged to the redirect target, which can be an attacker-controlled host. This results in disclosure of the caller's credentials. The vulnerability has a medium severity with a CVSS score of 6.5. No patch or official remediation has been confirmed yet.