CVE-2025-14524

{"id": "CVE-2025-14524", "cveTags": [], "metrics": {}, "published": "2026-01-08T10:15:46.607", "references": [{"url": "https://curl.se/docs/CVE-2025-14524.html", "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://curl.se/docs/CVE-2025-14524.json", "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://hackerone.com/reports/3459417", "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "http://www.openwall.com/lists/oss-security/2026/01/07/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}], "lastModified": "2026-01-08T18:08:18.457", "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9"}