A vulnerability in the curl-based HTTP transport of gix-transport causes user credentials to be leaked to an attacker-controlled host after an HTTP redirect. When a server issues a 302 redirect, the client rewrites subsequent requests to the redirected host but continues to attach the Authorization header based on the original URL, resulting in credentials being sent to the attacker. Additionally, an HTTPS-to-HTTP downgrade redirect can cause credentials to be sent in cleartext. This issue affects gix-transport versions from 0.25.4 up to but not including 0.56.0 and has been fixed in version 0.56.0.