urllib3 versions prior to 1.26.19 and from 2.0.0 up to but not including 2.2.2 have a vulnerability where the Proxy-Authorization header is not stripped during cross-origin redirects if set manually without using urllib3's proxy support. This can lead to unintended exposure of proxy authentication credentials during redirects. The issue is considered low risk for most users due to the unlikely conditions required for exploitation. A fix is available in versions 1.26.19 and 2.2.2.