Rclone versions prior to 1.75.2 have a vulnerability in the b2 backend where live account Authorization tokens and SSE-C keys can be leaked via HTTP redirects when using the --b2-download-url option. This occurs due to HTTPS-to-HTTP downgrade redirects or cross-host redirects that expose sensitive credentials. The issue is fixed in version 1.75.2.