A vulnerability in urllib3 versions prior to 2.7.0 allows sensitive headers such as Authorization, Cookie, and Proxy-Authorization to be forwarded during cross-origin redirects when using the low-level API via ProxyManager.connection_from_url(). This behavior contrasts with the expected stripping of these headers in high-level API calls. This issue affects applications and libraries that use urllib3's low-level redirect handling through HTTPConnection instances created by ProxyManager.connection_from_url().