CVE-2026-86413

Description

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

Traduire en français

Produits concernés

• curl

Références

• https://curl.se/docs/CVE-2026-86413.html
• https://curl.se/docs/CVE-2026-86413.json
• https://hackerone.com/reports/3993549

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories