CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

A flaw was found in libsoup where the proxy authentication logic in SoupAuthManager unconditionally attaches the Proxy-Authorization header to all outgoing requests, including those sent through an already-established CONNECT tunnel. This causes proxy credentials to be sent in cleartext to destination servers, which can capture and reuse them. This issue is distinct from CVE-2026-12547 which covers credential leak when switching between proxies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.