gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport…
Historical advisory recorded 25 Oct 2026 16:19:10 UTC. Read the latest advisory.
nvd · CVE-2026-82255
Publishedgitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-82255 · CVE overview and exploitation status
nvd · CVE-2026-82255
This historical advisory does not include today's related changes. Open the latest advisory to find current connections.