CVE-2026-3783

A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the .netrc file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent the leakage of OAuth2 bearer tokens, ensure that .netrc files are carefully managed. Avoid configuring .netrc entries for untrusted or unknown hostnames, particularly when curl is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in .netrc files to only explicitly trusted destinations.