CVE-2025-14524

bearer token leak on cross-protocol redirect

Published Jan 8, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,
POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new
target host.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

curl

unaffected

Version	Status	Constraints
`7.33.0`	affected	< 8.14.2
`8.15.0`	affected	< 8.16.1
`8.17.0`	affected	< 8.18.0

curl

unaffected

Version	Status	Constraints
`06c1bea72faabb6fad4b7ef818aafaa336c9a7aa`	affected	< 1a822275d333dc6da6043497160fd04c8fa48640

curl

unaffected

Version	Status	Constraints
`8.17.0`	affected	—
`8.16.0`	affected	—
`8.15.0`	affected	—
`8.14.1`	affected	—
`8.14.0`	affected	—
`8.13.0`	affected	—
`8.12.1`	affected	—
`8.12.0`	affected	—
`8.11.1`	affected	—
`8.11.0`	affected	—
`8.10.1`	affected	—
`8.10.0`	affected	—
`8.9.1`	affected	—
`8.9.0`	affected	—
`8.8.0`	affected	—
`8.7.1`	affected	—
`8.7.0`	affected	—
`8.6.0`	affected	—
`8.5.0`	affected	—
`8.4.0`	affected	—
`8.3.0`	affected	—
`8.2.1`	affected	—
`8.2.0`	affected	—
`8.1.2`	affected	—
`8.1.1`	affected	—
`8.1.0`	affected	—
`8.0.1`	affected	—
`8.0.0`	affected	—
`7.88.1`	affected	—
`7.88.0`	affected	—
`7.87.0`	affected	—
`7.86.0`	affected	—
`7.85.0`	affected	—
`7.84.0`	affected	—
`7.83.1`	affected	—
`7.83.0`	affected	—
`7.82.0`	affected	—
`7.81.0`	affected	—
`7.80.0`	affected	—
`7.79.1`	affected	—
`7.79.0`	affected	—
`7.78.0`	affected	—
`7.77.0`	affected	—
`7.76.1`	affected	—
`7.76.0`	affected	—
`7.75.0`	affected	—
`7.74.0`	affected	—
`7.73.0`	affected	—
`7.72.0`	affected	—
`7.71.1`	affected	—
`7.71.0`	affected	—
`7.70.0`	affected	—
`7.69.1`	affected	—
`7.69.0`	affected	—
`7.68.0`	affected	—
`7.67.0`	affected	—
`7.66.0`	affected	—
`7.65.3`	affected	—
`7.65.2`	affected	—
`7.65.1`	affected	—
`7.65.0`	affected	—
`7.64.1`	affected	—
`7.64.0`	affected	—
`7.63.0`	affected	—
`7.62.0`	affected	—
`7.61.1`	affected	—
`7.61.0`	affected	—
`7.60.0`	affected	—
`7.59.0`	affected	—
`7.58.0`	affected	—
`7.57.0`	affected	—
`7.56.1`	affected	—
`7.56.0`	affected	—
`7.55.1`	affected	—
`7.55.0`	affected	—
`7.54.1`	affected	—
`7.54.0`	affected	—
`7.53.1`	affected	—
`7.53.0`	affected	—
`7.52.1`	affected	—
`7.52.0`	affected	—
`7.51.0`	affected	—
`7.50.3`	affected	—
`7.50.2`	affected	—
`7.50.1`	affected	—
`7.50.0`	affected	—
`7.49.1`	affected	—
`7.49.0`	affected	—
`7.48.0`	affected	—
`7.47.1`	affected	—
`7.47.0`	affected	—
`7.46.0`	affected	—
`7.45.0`	affected	—
`7.44.0`	affected	—
`7.43.0`	affected	—
`7.42.1`	affected	—
`7.42.0`	affected	—
`7.41.0`	affected	—
`7.40.0`	affected	—
`7.39.0`	affected	—
`7.38.0`	affected	—
`7.37.1`	affected	—
`7.37.0`	affected	—
`7.36.0`	affected	—
`7.35.0`	affected	—
`7.34.0`	affected	—
`7.33.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Curl	Curl	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8062-1	curl vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.680% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/01/07/4
https://curl.se/docs/CVE-2025-14524.html
https://curl.se/docs/CVE-2025-14524.json
https://hackerone.com/reports/3459417

History

Sep 15, 2026 6:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-522

Jan 20, 2026 3:00 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Haxx Haxx curl
Weaknesses		CWE-601
CPEs		cpe:2.3:a:haxx:curl::::::::
Vendors & Products		Haxx Haxx curl

Jan 9, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 9, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Curl Curl curl
Vendors & Products		Curl Curl curl

Jan 8, 2026 11:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/01/07/4

Jan 8, 2026 10:15 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.
Title		bearer token leak on cross-protocol redirect
References		https://curl.se/docs/CVE-2025-14524.html https://curl.se/docs/CVE-2025-14524.json https://hackerone.com/reports/3459417