CVE-2026-86413 — Negotiate credentials sent to redirected origin
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second o…
Published: 2026-10-20 · CVSS: Unscored
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7