CVE-2026-33745

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.39.0

Description The cpp-httplib HTTP client improperly handles cross-origin HTTP redirects (301, 302, 307, 308). Specifically, it forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following these redirects. A malicious or compromised server can redirect the client to an attacker-controlled host, which then receives the plaintext credentials in the Authorization header. This could allow an attacker to obtain sensitive authentication information.

Recommendations Update cpp-httplib to version 0.39.0 or later.