Insufficiently Protected Credentials Affecting gix-transport package, versions >=0.25.4 <0.56.0

Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the curl backend during HTTP(S) operations involving redirects. An attacker can obtain sensitive credentials by controlling a redirect target, causing the client to send authentication information to an unintended host. This can occur when a server responds with a redirect to a malicious domain, and subsequent requests automatically include the Authorization header, exposing credentials to the attacker. Additionally, a redirect from HTTPS to HTTP can result in credentials being transmitted in cleartext over an unencrypted connection.

• GitHub Advisory
• GitHub Commit