An issue exists where Authorization headers and basic auth credentials are forwarded during cross-origin redirects. This occurs because the `sendCredentialsOnCrossOriginRedirect` setting defaults to true. An attacker who controls a redirect target or an expression-fed URL in nodes that use credentials can capture the stored workflow credentials sent to their endpoint.