The `HTTPPasswordMgr` class in the `urllib.request` module, including its subclasses `HTTPPasswordMgrWithDefaultRealm` and `HTTPPasswordMgrWithPriorAuth`, fails to consider the URL scheme when matching stored credentials to a requested URL. This allows credentials intended for `https://` to be sent over `http://` if an attacker can redirect or downgrade the client connection, potentially leading to the capture of credentials in cleartext. Conversely, credentials for `http://` could be sent over `https://`. Credential matching is now restricted by URL scheme, meaning credentials registered with a specific scheme are only used for requests using that same scheme, while those registered with a bare authority remain compatible with any scheme.