Kirill Podoprigora

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `HTTPPasswordMgr` class in the `urllib.request` module, including its subclasses `HTTPPasswordMgrWithDefaultRealm` and `HTTPPasswordMgrWithPriorAuth`, fails to consider the URL scheme when matching stored credentials to a requested URL. This allows credentials intended for `https://` to be sent over `http://` if an attacker can redirect or downgrade the client connection, potentially leading to the capture of credentials in cleartext. Conversely, credentials for `http://` could be sent over `https://`. Credential matching is now restricted by URL scheme, meaning credentials registered with a specific scheme are only used for requests using that same scheme, while those registered with a bare authority remain compatible with any scheme. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Ensure that applications do not make plain `http://` requests to hosts for which credentials are registered, such as by disabling the following of redirects to `http://` URLs.