CVE-2025-46421
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A flaw in the libsoup library causes HTTP clients to mistakenly send the Authorization header to the new host during a redirect. This allows the new host to impersonate the user to the original server.
Risk Assessment
The organization is at risk of user identity theft and unauthorized access to original server resources via a malicious intermediary host.
Recommendation
Update libsoup to a patched version and consider temporarily disabling automatic redirect following in applications using libsoup.
Original NVD description (English source)
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.