{"id":"CVE-2026-86413","published":"2026-10-20T20:17:25.787","lastModified":"2026-10-22T17:21:57.293","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://curl.se/docs/CVE-2026-86413.html","tags":[]},{"url":"https://curl.se/docs/CVE-2026-86413.json","tags":[]},{"url":"https://hackerone.com/reports/3993549","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}