Apache Juneau versions through 9.2.0 have an Insufficiently Protected Credentials vulnerability in the RestClient component. The RestClient followed HTTP redirects while retaining credential headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key from the original request. This behavior could expose sensitive credentials to unintended hosts or downgrade from HTTPS to HTTP, risking credential leakage. The issue is fixed in version 9.2.1 by changing the handling of redirects and credential headers.