When the redirect interceptor and a shared response cache are used together, an authenticated request redirected to a same-origin target stores the final response under the original request's cache key. Because this key omits credentials and lacks a Vary header, subsequent requests from anonymous or different users may be served the private response body of the first user, leading to cross-user disclosure of cached private responses.