CVE-2025-46421 in libsoup
Summary
by MITRE • 04/24/2025
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/04/2026
The vulnerability identified as CVE-2025-46421 represents a critical security flaw within the libsoup library, a widely-used HTTP client library in various applications and systems. This issue manifests when clients processing HTTP redirects fail to properly handle authentication headers during the redirection process, creating a significant vector for credential leakage and impersonation attacks. The flaw specifically affects how HTTP authorization tokens are managed when requests are redirected from one host to another, potentially exposing sensitive authentication information to unintended recipients.
This technical vulnerability stems from improper handling of HTTP headers during redirect operations, where the libsoup client library retains and forwards the Authorization header to the redirected host without appropriate validation or sanitization. The flaw essentially creates a situation where authentication credentials intended for the original host are inadvertently transmitted to a different host that the redirect points to, enabling malicious actors to exploit this behavior for unauthorized access. This type of vulnerability falls under the category of credential leakage and authentication bypass mechanisms, with direct implications for session management and access control systems that rely on proper header handling.
The operational impact of CVE-2025-46421 extends beyond simple information disclosure, as it enables sophisticated attack vectors that can lead to full system compromise. An attacker who controls the redirected host can potentially impersonate authenticated users to the original host, gaining unauthorized access to protected resources, sensitive data, and system functionalities. This vulnerability directly relates to CWE-598, which addresses information exposure through HTTP redirects, and represents a significant risk in environments where libsoup is used for web client operations, including web browsers, mobile applications, and server-side components. The attack surface is particularly concerning in scenarios involving enterprise applications, web services, and systems that depend on proper authentication mechanisms to maintain security boundaries.
Mitigation strategies for this vulnerability should focus on immediate library updates and configuration changes to prevent unauthorized header forwarding during redirects. System administrators and developers should implement proper header validation mechanisms, configure applications to not forward authentication headers across redirects, and establish monitoring for suspicious redirect patterns. The recommended approach includes updating to patched versions of libsoup, implementing explicit redirect policies that prevent header forwarding, and conducting security reviews of all applications that utilize this library. Additionally, organizations should consider implementing network-level controls to detect and prevent unauthorized credential transmission, aligning with ATT&CK technique T1566 for credential access through redirects and T1071 for application layer protocol usage. Regular security testing and vulnerability assessments should be conducted to ensure proper implementation of these mitigations across all affected systems and applications.