PHP contains an issue where credentials could be leaked during a redirect when using curl. This occurs when the application follows a redirect to an external host and inadvertently includes authentication credentials in the request to the new location.