CVE-2025-46421

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

A moderate-severity information disclosure flaw was found in libsoup, affecting the libsoup and libsoup3 components as shipped in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS, with the issue delegated to the Fedora community for community-project packages. When a libsoup-based client follows an HTTP redirect, it mistakenly sends the HTTP Authorization header to the new host that the redirect points to. This allows the host that is the target of the redirection to capture the client's credentials and impersonate the user to the original host that issued the redirect. Exploitation requires network access with high attack complexity, no privileges, and user interaction, and affects the confidentiality and integrity of the authenticated session but not availability. Red Hat and the upstream CVE record both assess this flaw with a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), so the Red Hat severity matches upstream. A fix for the affected Red Hat products is being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Currently, no mitigation is available for this vulnerability.