Olaf Alders

**Name of the Vulnerable Software and Affected Versions** HTTP::Tiny versions prior to 0.095 **Description** When a server returns a 3xx redirect, the ` maybe redirect` function follows the `Location:` header and the ` prepare headers and cb` function re-merges the caller's `headers` argument into the new request. This process occurs without verifying if the redirect target shares an origin with the original URL. Consequently, caller-supplied `Authorization`, `Cookie`, and `Proxy-Authorization` headers are sent to any host specified in the redirect, regardless of scheme, host, or port boundaries. This includes downgrades from `https` to `http`, which can expose these credentials in plaintext. **Recommendations** Update to version 0.095 or later.